CYPHERLOCK, INC.

Vulnerability in WordPress Plugin Leaves 1 Million Sites Open to Remote Code Exploits

A critical security flaw in the WPML (WordPress Multilingual) plugin has exposed over a million WordPress sites to the threat of remote code execution (RCE) attacks.

This vulnerability allows authenticated users with at least contributor-level access to execute arbitrary code on the server, which could result in complete control over the affected site. Designated as CVE-2024-6386, the flaw impacts all versions of the WPML plugin up to and including 4.6.12. The vulnerability was uncovered by a security researcher operating under the alias “stealth copter” and was responsibly reported via the Wordfence Bug Bounty Program, earning the researcher a reward of $1,639 for this significant discovery.

Technical Details

The root of the issue lies in insufficient input validation and sanitization within the plugin’s use of Twig, a widely-used templating engine. The vulnerability specifically exists in the render() function of the WPML_LS_Public_API class, which handles user-provided Twig templates without adequate sanitization.

This flaw opens the door to server-side template injection, where attackers can inject and execute harmful code.

protected function render( $args, $twig_template = null ) {
    $defaults_slot_args = $this->get_default_slot_args( $args );
    $slot_args = array_merge( $defaults_slot_args, $args );
    $slot = $this->get_slot_factory()->get_slot( $slot_args );
    $slot->set( 'show', 1 );
    $slot->set( 'template_string', $twig_template );
    if ( $slot->is_post_translations() ) {
        $output = $this->render->post_translations_label( $slot );
    } else {
        $output = $this->render->render( $slot );
    }
    return $output;
}

The function above fails to properly sanitize the Twig template, which means attackers can create templates that execute arbitrary PHP code.

Proof-of-Concept

A proof-of-concept exploit has been demonstrated, showing how this vulnerability can be exploited. By utilizing the

[wpml_language_switcher] shortcode, attackers can inject Twig code that runs PHP functions, such as phpinfo(), exposing sensitive server information.

[wpml_language_switcher]

{% set call_user_func = c~a~l~l~_~u~s~e~r~_~f~u~n~c %}

{% set phpinfo = p~h~p~i~n~f~o %}

{{ {1: phpinfo}|filter(call_user_func) }}

[/wpml_language_switcher]


This example demonstrates how Twig’s filter function can be used to call phpinfo(), showcasing the potential for more damaging exploits.


Wordfence promptly responded by issuing a firewall rule on June 27, 2024, to safeguard its premium users. Protection for free users was rolled out a month later.


Despite some initial communication hurdles, the WPML development team released a patch on August 20, 2024, with version 4.6.13, addressing this security flaw.


Users are strongly advised to update to the latest version of WPML to minimize the risk. The vulnerability’s critical CVSS score of 9.9 emphasizes the urgency of applying this update. This incident underscores the need for stringent security measures and timely updates within the WordPress ecosystem.


As plugins become more sophisticated, vulnerabilities like this one remind users of the inherent risks associated with third-party integrations. Users are urged to stay vigilant and proactive in ensuring their site's security.

More Articles & Posts

Scopes

2025 Active Exploitation AI Alert Analysis Attack Attackers Attacks Breach Breaches Campaigns China chrome CISA Cisco CISO CISOs credentials Critical Critical Flaw Critical Vulnerability CrowdStrike Cutting-Edge Cyber Attack Cyberattack cyberattacks Cybercriminals cybersecurity Cybersecurity Initiatives Cybersecurity Solutions Cyber Threats DDoS Attacks Discovered Enables Exploit Exploited Exploiting Exploits Exposes FBI Flaw Generative AI google Guide Hackers Hackers Exploit Healthcare Hijack Hit Insights Invest Ivanti Linux macOS malicious malware Massive data Breach MFA microsoft Microsoft 365 Microsoft Azure NIST Patch Phishing Phishing Attack PoC Privilege Escalation Ransomware Ransomware Attack ransomware attacks RCE RCE Vulnerability Released Remote Code Execution Researchers risk Scam security Security Flaw Strategies Strategy Systems Target Targeted Targeting Targets Threat Actors Threat Intelligence threats UK Unauthorized Code Execution Under Attack Users vulnerabilities Vulnerability WhatsApp windows Windows 11 Windows Systems Zero-Day