WordPress admins ought to as soon as once more replace their web sites to obtain plugin updates, notably in the event that they run the WPML plugin. Researchers discovered a crucial vulnerability within the WPML plugin, permitting distant code execution assaults.
WPML WP Plugin Vulnerability Allowed Distant Code Execution
A safety researcher with the alias “stealthcopter” found a crucial vulnerability within the WPML WordPress plugin.
As defined in his weblog submit, the vulnerability might enable an authenticated distant adversary to execute malicious codes on the goal web site.
Particularly, the difficulty exists within the “dealing with of shortcodes throughout the plugin”. Because of improper enter sanitization whereas rendering shortcodes by way of Twig templates, server-side template injection (SSTI) turns into attainable. Therefore, an adversary with authenticated entry to the goal web site could inject malicious codes.
The researcher responsibly disclosed the vulnerability by way of the Wordfence bug bounty program. In accordance with Wordfence advisory, the vulnerability, recognized as CVE-2024-6386, obtained a crucial severity score with a CVSS rating of 9.9. Describing the flaw, the advisory reads,
The WPML plugin for WordPress is susceptible to Distant Code Execution in all variations as much as, and together with, 4.6.12 by way of Twig Server-Aspect Template Injection. This is because of lacking enter validation and sanitization on the render perform. This makes it attainable for authenticated attackers, with Contributor-level entry and above, to execute code on the server.
The researchers introduced a PoC for the vulnerability in his weblog submit. He additionally emphasised the necessity for builders to make sure correct sanitization and validation of person enter, notably throughout dynamic content material rendering.
Patch Deployed
Following the researcher’s bug report, Wordfence coordinated with the plugin builders to repair the vulnerability. Consequently, the flaw that affected all plugin variations till v.4.6.12 ultimately obtained a patch with WPML 4.6.13 and WooCommerce Multilingual 5.3.7.
In addition to making certain immediate vulnerability repair from the builders, Wordfence additionally rewarded the researcher with a $1,639 bounty for the bug report.
WPML plugin is a devoted WooCommerce plugin providing multilingual and multicurrency assist for web sites. It presently boasts over 100,000 energetic installations, representing the sheer variety of web sites doubtlessly in danger because of plugin vulnerabilities. Subsequently, it’s essential for all WordPress admins working this plugin to replace their websites with the most recent plugin launch.
Tell us your ideas within the feedback.