Vulnerability Discovered in WPML, Popular WordPress Multilingual Plugin

As reported by Cybernews today, WPML, a popular tool for creating multilingual WordPress websites, is vulnerable to cyber-attacks. This security flaw, discovered by security researcher “stealth copter,” could allow attackers to execute code remotely on vulnerable websites.

Cybernews notes that WPML, with over a million active installations, is a widely used plugin for managing translations and language switching on WordPress sites. However, the researcher reported that the plugin’s handling of certain content types was susceptible to server-side template injection attacks.

By exploiting this vulnerability, attackers could potentially gain unauthorized access to a website’s server and steal sensitive information, such as passwords, user data, and other confidential information.

“The crafted payload uses the dump function to gather letters needed to construct commands without using quotes. Once we have basic command execution, we can further leverage it to gain more control over the server,” the researcher said in his report.

The researcher demonstrated the vulnerability by successfully executing a malicious shortcode within the WordPress editor. While crafting complex commands might require additional workarounds, the potential consequences of a successful attack are severe.

This incident underscores that security is an ongoing process that demands vigilance throughout all stages of development and data handling.

The researcher concludes that this vulnerability highlights the risks of inadequate input sanitization in templating engines. He advises that developers consistently sanitize and validate user inputs, particularly when rendering dynamic content.

Stealthcopter reported this vulnerability via the Wordfence Bug Bounty Program and received a bounty of $1,639.00, as noted by Wordfence. Wordfence states that this vulnerability has been addressed in version 4.6.13 of WPML and strongly advises users to update their sites to the latest patched version as soon as possible.