CVE-2026-122084
CVE-2026-122084 is a vulnerability with no CVSS score yet in drupal/wordsonline_connector, published November 4, 2026. No source lists public exploit code. Fixed in drupal/wordsonline_connector 2.0.6.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.6drupal/wordsonline_connector
Description
The WordsOnline Connector module integrates Drupal with the WordsOnline translation service through the TMGMT module.
The module doesn't properly validate data, resulting in an SQL Injection vulnerability. An attacker can use this to read data from the Drupal database, including user account data.
The vulnerability is mitigated by the fact that an attacker must be logged in and hold the Create translation jobs permission provided by TMGMT.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/wordsonline_connectorPackagist:https://packages.drupal.org/8 | 2.0.0 up to 2.0.6 | 2.0.6 |
What each source reports
OSVDRUPAL-CONTRIB-2026-310No score
The WordsOnline Connector module integrates Drupal with the WordsOnline translation service through the TMGMT module.
The module doesn't properly validate data, resulting in an SQL Injection vulnerability. An attacker can use this to read data from the Drupal database, including user account data.
The vulnerability is mitigated by the fact that an attacker must be logged in and hold the Create translation jobs permission provided by TMGMT.
- Record
DRUPAL-CONTRIB-2026-310- Updated
- 2026-11-04
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.