Uber: Multiple Vulnerabilities (Including SQLi) in love.uber.com

Hi,
I noticed you are using a critically vulnerable version of WMPL.

By accessing http://love.uber.com/wp-content/plugins/sitepress-multilingual-cms/changelog.md,
Attacker could find out http://love.uber.com/ is running WMPL version 3.1.8.4

######Which is Vulnerable to,

1. SQL injection which gives full access to the WordPress database.
2. Page, post and menu deletion by an unauthenticated attacker
3. Unauthenticated administrative functions which may lead to RCE (remote code execution)
4. Cross Site Scripting (XSS)

###SOURCES:

• https://klikki.fi/adv/wpml.html
• https://vulners.com/cve/CVE-2015-2791
• https://www.exploit-db.com/exploits/36414/
• http://darkmatters.norsecorp.com/2015/03/16/four-wordpress-wpml-plugin-vulnerabilities-impact-400000-websites/

###FIX:
According to Official WPML Security update,
System administrators should update to at-least version 3.1.9 which was released on march 11th, 2015 to resolve these issues.

looking forward!