CVE-2024-6386 Code injection in WPML
Authenticated attackers with Contributor access can execute arbitrary code on the server via Twig Server-Side Template Injection in the WPML plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6386?
CVE-2024-6386 is a critical code injection vulnerability in WPML, published on 21 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Which versions are affected by CVE-2024-6386?
It affects 1 product.
Products include Wpml Wpml.
How do I fix CVE-2024-6386?
No fix has been published for CVE-2024-6386 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-6386 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6386 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in WPML
Sources
Also known as GHSA-q8gr-qpfg-hv8p.