<h1>Critical Vulnerability Patched in WPML WordPress Plugin: Immediate Update Required</h1>
<p>A critical Remote Code Execution (RCE) vulnerability has been patched in the WPML WordPress plugin, which is utilized by over a million websites globally. This vulnerability, identified as CVE-2024-6386, has been rated with a CVSS score of 9.9 out of 10, underscoring its severity. The issue affects all versions of the plugin prior to 4.6.13, and users are strongly advised to update to the latest version immediately to protect their sites.</p>
<h2>Details of the Vulnerability</h2>
<p>Security researcher Mat Rollings discovered the flaw, which is tied to a Twig Server-Side Template Injection due to missing input validation in the plugin’s render function. This allowed authenticated users with Contributor-level access to execute arbitrary code remotely. Detailed technical aspects of the vulnerability have been shared by Rollings on his blog.</p>
<h2>Urgent Need for Update</h2>
<p>The latest update, which was released on August 20, 2024, addresses this critical security issue. Users of the WPML plugin should upgrade to version 4.6.13 without delay to mitigate potential threats.</p>
<h2>A Broader Context of Plugin Security</h2>
<p>This recent patch is part of a broader wave of security improvements in WordPress plugins. Researchers have received over $21,000 in bounties for identifying critical vulnerabilities in various plugins, including GiveWP, LiteSpeed Cache, and WPML. These efforts are essential in maintaining the security and integrity of the WordPress ecosystem.</p>
<p>In summary, website administrators are urged to ensure that their WPML plugin is up to date to defend against potential exploitation.</p>


Collections

A critical Remote Code Execution (RCE) vulnerability in the WPML WordPress plugin has been patched. With a CVSS score of 9.9, the issue affects all versions prior to 4.6.13, and users are urged to update immediately to version 4.6.13. The vulnerability allowed authenticated users with Contributor-level access to execute arbitrary code remotely. This patch is part of broader security improvements in WordPress plugins.