What is the CVSS score of CVE-2024-6386?

CVE-2024-6386 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 73.9%.

Which versions of WPML are affected by CVE-2024-6386?

WPML, a critical WordPress multilingual plugin used across thousands of sites, contains a remote code execution vulnerability in versions up to 4.6.12 that requires only Contributor-level user access…

Is there a public PoC exploit available for CVE-2024-6386?

Yes, a public proof-of-concept exploit is available for CVE-2024-6386. Prioritise patching immediately. EPSS: 73.9%.

How to fix or mitigate CVE-2024-6386?

Within 24 hours: Audit all WordPress installations for WPML presence and version; disable or uninstall the plugin immediately on production systems as a temporary containment measure. Within 7 days: Evaluate long-term multilingual strategy (alternative plugins, platform migration); implement least-privilege access controls limiting Contributor role to essential staff only. Within 30 days: Deploy WPML patched version as soon as vendor releases one; execute systematic upgrade across all WordPress environments with change control and backup procedures.

WPML CVE-2024-6386

CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2024-08-21 security@wordfence.com

Ssti RCE WordPress Wpml

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Apr 08, 2026 - 19:22 vuln.today

Public exploit code

CVE Published

Aug 21, 2024 - 21:15 nvd

CRITICAL 9.9

DescriptionCVE.org

The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

AnalysisAI

Remote code execution in the WPML WordPress multilingual plugin (versions up to and including 4.6.12) allows Contributor-level authenticated users to execute arbitrary code on the underlying server via Twig Server-Side Template Injection in the shortcode render function. Publicly available exploit code exists and EPSS rates the exploitation probability at 73.91% (99th percentile), making this a high-priority issue for any WordPress site running WPML.

Technical ContextAI

WPML is one of the most widely deployed multilingual plugins for WordPress, identified by CPE cpe:2.3:a:wpml:wpml:*:*:*:*:*:wordpress:*:*. The flaw is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), specifically a Server-Side Template Injection (SSTI) flaw in WPML's use of the Twig templating engine. When user-controlled input reaches Twig's render function without sanitization, attackers can inject template syntax that Twig evaluates server-side, abusing Twig's object filters and PHP interoperability to reach arbitrary PHP execution from what is normally rendered as benign shortcode output.

RemediationAI

Upgrade WPML to version 4.6.13 or later, which the vendor released to address the Twig SSTI; cite the Wordfence Threat Intelligence advisory and the WPML release notes on wpml.org for the authoritative fix reference. Until upgrade is possible, restrict who can author content by removing or downgrading untrusted Contributor and Author accounts, temporarily disable open user registration, and audit existing low-privilege users for unexpected activity; on multisite deployments, consider deactivating WPML on lower-trust sites. As compensating controls, deploy a WAF rule that blocks Twig-style payloads (such as {{, }}, and known Twig sandbox-escape gadgets) in WPML shortcode parameters, knowing this may produce false positives on legitimate multilingual content and is not a substitute for patching.