CVE-2024-6386

The vulnerability results from lack of validation and sanitization of input data in the render function handling Twig templates. An attacker with Contributor level access or higher can inject malicious code into a Twig template, which is then executed on the server side. The lack of proper input filtering allows malicious payload to be passed directly to the template engine, bypassing security mechanisms.

An authenticated attacker can gain full control over the server through remote code execution, leading to complete compromise of confidentiality, integrity and availability of the system — including the possibility of server takeover, data breach and installation of backdoors.

Update the WPML plugin to a version higher than 4.6.12. Patches are available from the vendor according to references on the wpml.org website. Additionally, it is recommended to restrict user permissions to Contributor level where not necessary.

WPML plugin for WordPress in all versions up to and including 4.6.12