Vulnerability Description
The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wpml | Wpml | < 4.6.13 |
Related Weaknesses (CWE)
References
- https://sec.stealthcopter.com/wpml-rce-via-twig-ssti/ExploitThird Party Advisory
- https://wpml.org/Product
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f7fc91cc-e529-4362-826Third Party Advisory
FAQ
What is CVE-2024-6386?
CVE-2024-6386 is a vulnerability with a CVSS score of 9.9 (CRITICAL). The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and s...
How severe is CVE-2024-6386?
CVE-2024-6386 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-6386?
Check the references section above for vendor advisories and patch information. Affected products include: Wpml Wpml.