Critical WPML Plugin Flaw Exposes WordPress Sites to Remote Code Execution

Critical WPML Plugin Flaw Exposes WordPress Sites to Remote Code Execution

August 28, 2024 at 12:33AM

A critical security flaw in WPML plugin (CVE-2024-6386, CVSS score: 9.9) allows authenticated users to remotely execute arbitrary code before version 4.6.13. With Contributor-level access, attackers can exploit missing input validation and sanitization. This popular multilingual WordPress plugin has over one million installations and users are advised to apply the latest patches.

Meeting Summary – August 28, 2024

Topic: WordPress Security / Website Protection
Presenter: Ravie Lakshmanan

Key Points:
– A critical security flaw, CVE-2024-6386 with a CVSS score of 9.9, has been discovered in the WPML WordPress multilingual plugin.
– The vulnerability affects all versions of the plugin prior to 4.6.13, released on August 20, 2024.
– Authenticated users with Contributor-level access and above can exploit the flaw to execute arbitrary code on the server.
– The issue stems from missing input validation and sanitization, allowing attackers to use native template syntax for server-side template injection (SSTI).
– OnTheGoSystems, the plugin maintainers, have released a fix, stating that the real-world occurrence of the issue is unlikely but encourage users to apply the latest patches as a precaution.

Action Item:
– Users of the WPML plugin should apply the latest patches to protect against potential threats.

Please let me know if you need anything else!

Full Article