PT-2024-5841 · WordPress · Wpml

Matthew Rollings

+1

·

Published

2024-02-09

·

Updated

2025-01-07

·

CVE-2024-6386

Report an issue
CVSS v3.1
9.9
VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

WPML versions up to, and including, 4.6.12

Description:

The WPML plugin for WordPress is vulnerable to Remote Code Execution via the Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function, making it possible for authenticated attackers with Contributor-level access and above to execute code on the server. Over a million WordPress sites are at risk. The vulnerability is related to the lack of input validation, allowing attackers to execute code remotely.

Recommendations:

Update to version 4.6.13 or later to patch the critical flaw.

As a temporary workaround, consider disabling the render function or restricting access to the vulnerable plugin until a patch is applied.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94CWE-1336

Related Identifiers

BDU:2024-06586
CVE-2024-6386

Affected Products

Wpml