CVE-2015-2791

🗓️ 30 Mar 2015 14:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 77 Views🌐 WEB

The "menu sync" function in WPML plugin allows remote attackers to delete arbitrary posts, pages, and menus

Reporter	Title	Published	Views	Family All 11
CNVD	WordPress plugin WPML 'menu sync' function has unspecified vulnerability	31 Mar 201500:00	–	cnvd
Cvelist	CVE-2015-2791	30 Mar 201514:00	–	cvelist
Exploit DB	WordPress Plugin WPML 3.1.9 - Multiple Vulnerabilities	16 Mar 201500:00	–	exploitdb
Hacker One	Uber: Multiple Vulnerabilities (Including SQLi) in love.uber.com	18 Feb 201603:27	–	hackerone
Kaspersky	KLA10491 Multiple vulnerabilities in WordPress plugins	17 Mar 201500:00	–	kaspersky
NVD	CVE-2015-2791	30 Mar 201514:59	–	nvd
Patchstack	WordPress WPML Plugin <= 3.1.8 - SQL Injection #1	30 Mar 201500:00	–	patchstack
Prion	Design/Logic Flaw	30 Mar 201514:59	–	prion
Positive Technologies	PT-2015-5897	30 Mar 201500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2015-2791: Undefined Security Weakness	30 Mar 201500:00	–	rapid7

NVD

Node

wpml wpmlRange≤3.1.8wordpress

Source	Link
klikki	www.klikki.fi/adv/wpml.html
wpml	www.wpml.org/2015/03/wpml-security-update-bug-and-fix/
securityfocus	www.securityfocus.com/archive/1/534862/100/0/threaded
packetstormsecurity	www.packetstormsecurity.com/files/130810/WordPress-WPML-XSS-Deletion-SQL-Injection.html
seclists	www.seclists.org/fulldisclosure/2015/Mar/71

Parameter	Position	Path	Description	CWE
action	request body	/comments/feed	SQL injection via WPML 'action=wp-link-ajax' in a POST to /comments/feed with crafted referer	CWE-264
action	request body	/?page=sitepress-multilingual-cms/menu/menus-sync.php	Unauthenticated deletion of posts/pages/menus via menus-sync.php	CWE-264
sync	request body	/?page=sitepress-multilingual-cms/menu/menus-sync.php	Unauthenticated deletion of posts/pages/menus via menus-sync.php	CWE-264

17 Jun 2026 00:24Current

6.9Medium risk

Vulners AI Score6.9

CVSS 26.4

EPSS0.13294