CVE-2024-6386

CVE-2024-6386 is a critical Remote Code Execution (RCE) vulnerability affecting all versions of the WPML plugin for WordPress up to and including 4.6.12. This flaw stems from insufficient input validation and sanitization in the render function, specifically due to a Twig Server-Side Template Injection. Authenticated attackers with Contributor-level access or higher can exploit this to execute arbitrary code on the server. The vulnerability carries a high CVSS score of 8.8, indicating a severe impact with high confidentiality, integrity, and availability compromise. It is easily exploitable over the network with low attack complexity and no user interaction required. The FAUCET Risk Score is exceptionally high at 99/100, and its EPSS score is in the top 1% of all CVEs. While there is no evidence of active exploitation in the wild (not in KEV), and no public exploit code (Metasploit, Nuclei, ExploitDB) is currently available, the vulnerability has garnered significant community attention with multiple discussions and media coverage from reputable cybersecurity outlets, suggesting a high potential for future exploitation.