CVE-2022-3141

The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

4.16% chance of exploitation in the next 30 days, 90th percentile

Published

2022-09-19

Updated

2024-08-03

Proof-of-concept exploits (3)

• https://wpscan.com/vulnerability/1fa355d1-cca8-4b27-9d21-0b420a2e1bf3
• Tomoe-12/CVE_2022_31411★ · 2025-09-05
• ehtec/translatepress-exploit1★ · 2022-09-24

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51043

References

• CVE Record
• NVD entry

Related

• CVE-2022-3142
• CVE-2022-35411
• CVE-2022-37109
• CVE-2023-41580
• CVE-2022-31403
• CVE-2022-31415