Critical vulnerability reported in WordPress Multilingual WPML Plugin
Take action: If you are using WPML (WordPress Multilingual) plugin, time to patch ASAP. While the exploit scenario may not be immediate, it will happen - especially with an available proof of concept. Patch now, it's fairly easy.
Learn More
A critical vulnerability has been identified in the WPML (WordPress Multilingual) plugin, which impacts over one million WordPress installations. The vulnerability, tracked as CVE-2024-6386 (CVSS score 9.9), allows authenticated attackers to execute remote code, potentially leading to a complete site takeover.
The vulnerability stems from inadequate sanitization within the WPML plugin. Specifically, the issue is found in a shortcode function used to create custom language switchers. This function improperly processes user input, allowing server-side template injection (SSTI) through unsanitized data. As a result, attackers with contributor-level permissions can exploit this flaw to inject malicious code, leading to remote code execution (RCE).
All versions of the WPML plugin up to and including 4.6.12 are vulnerable. The vulnerability was discovered in late June 2024, but the plugin's developer, OnTheGoSystems, did not respond promptly, delaying the patch release until August 20, 2024, in version 4.6.13.
Users of the WPML plugin are strongly advised to update to the latest version, 4.6.13, as soon as possible to mitigate the risk of exploitation.
OnTheGoSystems has downplayed its potential impact, suggesting that the exploit requires specific conditions that may not be present in most real-world scenarios. Nevertheless, the availability of proof-of-concept (PoC) code makes immediate action critical.
