{"id":"CVE-2024-6386","aliases":["EUVD-2024-47493","GHSA-q8gr-qpfg-hv8p"],"status":"published","title":"WPML Multilingual CMS \u003c= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection","description":"The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.25533,"percentile":0.9798,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-1336","CWE-94"],"published":"2024-08-21T20:29:23Z","modified":"2026-06-17T08:17:54Z","exploits":[{"source":"pocgithub","id":"argendo/CVE-2024-6386","title":"argendo/CVE-2024-6386","date":"2024-09-05","url":"https://github.com/argendo/CVE-2024-6386"},{"source":"pocgithub","id":"bananoname/CVE-2024-6386-WPML-SSTI","title":"bananoname/CVE-2024-6386-WPML-SSTI","date":"2026-02-10","url":"https://github.com/bananoname/CVE-2024-6386-WPML-SSTI"}],"products":[{"vendor":"wpml","product":"wpml"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f7fc91cc-e529-4362-8269-bf7ee0766e1e?source=cve","tags":["Third Party Advisory"]},{"url":"https://wpml.org/","tags":["Product"]},{"url":"https://sec.stealthcopter.com/wpml-rce-via-twig-ssti/","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6386"},{"url":"https://sec.stealthcopter.com/wpml-rce-via-twig-ssti"},{"url":"https://wpml.org"},{"url":"https://github.com/advisories/GHSA-q8gr-qpfg-hv8p"}],"sources":{"cve":[{"id":"CVE-2024-6386","title":"WPML Multilingual CMS \u003c= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection","description":"The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.","status":"published","published":"2024-08-21T20:29:23.09Z","modified":"2026-04-08T17:33:51.326Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T14:34:11.305983Z"}],"euvd":[{"id":"EUVD-2024-47493","description":"The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.","status":"published","published":"2024-08-21T20:29:23Z","modified":"2026-04-08T17:33:51Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:24:32.88989Z"}],"ghsa":[{"id":"GHSA-q8gr-qpfg-hv8p","title":"The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and...","description":"The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via the Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.","status":"published","published":"2024-08-21T21:30:46Z","modified":"2024-09-27T15:31:37Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94","CWE-1336"],"updated_at":"2026-11-02T14:58:21.889894Z"}],"nvd":[{"id":"CVE-2024-6386","description":"The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.","status":"published","published":"2024-08-21T21:15:08.577Z","modified":"2026-06-17T08:17:54.557Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1336","CWE-94"],"updated_at":"2026-11-02T14:10:19.870727Z"}]}}