WordPress Plugin Vulnerable to Remote Code Execution
CVE-2024-6386

8.8HIGH

Key Information:

Vendor
WPML
Status
WPml
Vendor
CVE Published:
21 August 2024

Badges

📈 Score: 1,370👾 Exploit Exists🟡 Public PoC📰 News Worthy

Summary

A critical vulnerability (CVE-2024-6386) in the popular WPML WordPress Multilingual plugin has been discovered, allowing for remote code execution. This vulnerability affects all versions up to 4.6.12, making it possible for attackers with Contributor-level access or above to execute code on the server. The security firm Wordfence has facilitated the disclosure of the flaw and researchers have earned bounties for reporting critical plugin vulnerabilities. The issue was resolved in WPML version 4.6.13, and users are strongly encouraged to update to that version as soon as possible. Publicly available proof-of-concept code targeting the vulnerability has raised concerns about the potential exploitation of this issue, as it could lead to complete site compromise through various techniques.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-6386
Created by Argendo

News Articles

favicon imageCyber Security News

RCE Vulnerability in 1,000,000 WordPress Sites Lets Attackers Gain Control Over Backend

A critical Remote Code Execution (RCE) vulnerability (CVE-2024-6386), affecting over 1,000,000 active installations of the WordPress Multilingual Plugin (WPML) Twig template engine.

1 month ago

favicon imageThe Hacker News

Critical WPML Plugin Flaw Exposes WordPress Sites to Remote Code Execution

Urgent security update for WPML WordPress plugin: Critical flaw allows remote code execution.

4 months ago

favicon imageWP Tavern

Remote Code Execution Vulnerability Patched in WPML WordPress Plugin

The popular WordPress Multilingual plugin, WPML, which is installed on over 1,000,000 websites, has patched a Remote Code Execution (RCE) vulnerability (CVE-2024-6386) that researchers have classif…

5 months ago

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wpml.org/
https://sec.stealthcopter.com/wpml-rce-via-twig-ssti/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • 📰

    First article discovered by SecurityWeek

  • Vulnerability published

.