CVE-2024-6386: The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This…

PriorityP272high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

25.01%

97.6th percentile

The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
wpml	wpml	< 4.6.13	4.6.13
wpml	wpml	<= 4.6.12	—

Detection & IOCsextracted from sources · hover to see the quote

→Check Point IPS signature available for this vulnerability ↗
→Vulnerability is exploitable by authenticated users with Contributor-level access or above via Twig Server-Side Template Injection in the render function — monitor for SSTI payloads in WPML plugin requests ↗
→Attack vector is injection of arbitrary PHP code via Twig templates in the WPML plugin — detect Twig template injection patterns (e.g., {{...}} with PHP function calls) in POST requests to WordPress endpoints ↗

·Over 1 million WordPress sites use this plugin, making the attack surface extremely broad ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.