A important vulnerability was found within the WPML WordPress plugin, affecting over one million installations. The vulnerability permits an authenticated attacker to carry out distant code execution, probably resulting in a complete website takeover. It’s listed as rated 9.9 out of 10 by the Frequent Vulnerabilities and Exposures (CVE) group.
WPML Plugin Vulnerability
The plugin vulnerability is because of a scarcity of a safety test known as sanitization, a course of for filtering person enter knowledge to guard in opposition to the add of malicious recordsdata. Lack of sanitization on this enter makes the plugin weak to a Distant Code Execution.
The vulnerability exists inside a operate of a shortcode for making a customized language switcher. The operate renders the content material from the shortcode right into a plugin template however with out sanitizing the information, making it weak to code injection.
The vulnerability impacts all variations of the WPML WordPress plugin as much as and together with 4.6.12.
Timeline Of Vulnerability
Wordfence found the vulnerability in late June and promptly notified the publishers of WPML which remained unresponsive for a couple of month and a half, confirming response on August 1, 2024.
Customers of the paid model of Wordfence obtained safety eight days after discovery of the vulnerability, the free customers of Wordfence obtained safety on July twenty seventh.
Customers of the WPML plugin who didn’t use both model of Wordfence didn’t obtain safety from WPML till August twentieth, when the publishers lastly issued a patch in model 4.6.13.
Plugin Customers Urged To Replace
Wordfence urges all customers of the WPML plugin to ensure they’re utilizing the newest model of the plugin, WPML 4.6.13.
They wrote:
“We urge customers to replace their websites with the newest patched model of WPML, model 4.6.13 on the time of this writing, as quickly as potential.”
Learn extra concerning the vulnerability at Wordfence:
Featured Picture by Shutterstock/Luis Molinero
