CVE-2015-2791
The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to...
CVE-2015-2791 is a medium vulnerability (CVSS 6.4) in Wpml, published March 30, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 12.9%, the 96th percentile. No source names a fixed version.
- Severity
- 6.4 MediumCVSS 2.0, NVD
- Exploit chance
- 12.9%EPSS, 96th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/menus-sync.php.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Plugin WPML 3.1.9 - Multiple Vulnerabilities | 2015-03-16 |
What each source reports
NVD Score used
The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/menus-sync.php.
- Record
CVE-2015-2791- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/menus-sync.php.
- Record
CVE-2015-2791- Updated
- 2026-11-02
EUVDEUVD-2015-2880No score
The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/menus-sync.php.
- Record
EUVD-2015-2880- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fjxm-8vv5-3pc6No score
The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to...
The "menu sync" function in the WPML plugin before 3.1.9 for WordPress allows remote attackers to delete arbitrary posts, pages, and menus via a crafted request to sitepress-multilingual-cms/menu/menus-sync.php.
- Record
GHSA-fjxm-8vv5-3pc6- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
wpml.org/2015/03/wpml-security-update-bug-and-fix
klikki.fi/adv/wpml.html
seclists.org/fulldisclosure/2015/Mar/71
securityfocus.com/archive/1/534862/100/0/threaded
packetstormsecurity.com/files/130810/WordPress-WPML-XSS-Deletion-SQL-Injection.html
nvd.nist.gov/vuln/detail/CVE-2015-2791
github.com/advisories/GHSA-fjxm-8vv5-3pc6