CVE-2015-2791

The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to...

6.4 MediumPublic exploit

The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/menus-sync.php.

Exploit likelihood

13.3%Up 12.1 points since Feb 4, 2022

What each source reports

NVD Score used 6.4

Record: CVE-2015-2791
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:N/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-2791
Updated: 2026-11-02

EUVDEUVD-2015-2880 No score

Record: EUVD-2015-2880
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fjxm-8vv5-3pc6 No score

The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to...

Record: GHSA-fjxm-8vv5-3pc6
Updated: 2026-11-02

Affected products

wpml

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	WordPress Plugin WPML 3.1.9 - Multiple Vulnerabilities	2015-03-16

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-2791 is a medium vulnerability (CVSS 6.4) in Wpml, published March 30, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.3%, the 96th percentile. No source names a fixed version.