CVE-2024-6386

HIGH

CVSS v3

8.8

HIGH

EPSS Score

73.8%

exploit probability

CISA KEV

No

known exploited

Exploitation

SSVC status

Description

The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via the Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Technical Details

Published
8/21/2024

Frequently Asked Questions

What is CVE-2024-6386?

The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via the Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Is CVE-2024-6386 actively exploited?

Active exploitation of CVE-2024-6386 has not been confirmed. The EPSS score is 73.8%, indicating the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2024-6386?

CVE-2024-6386 has a CVSS v3 base score of 8.8 (HIGH severity).

Is CVE-2024-6386 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.