Описание
The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via the Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Ссылки
- ExploitThird Party Advisory
- Product
- Third Party Advisory
Уязвимые конфигурации
EPSS
9.9 Critical
CVSS3
8.8 High
CVSS3
Дефекты
Связанные уязвимости
The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via the Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.
Уязвимость плагина WPML системы управления содержимым сайта WordPress, позволяющая нарушителю выполнить произвольный код
EPSS
9.9 Critical
CVSS3
8.8 High
CVSS3