WPML CVE-2024-6386

Exploitation requires an authenticated WordPress account at Contributor role or higher on a site with the WPML plugin installed and activated at version 4.6.12 or earlier, and the attacker must be able to submit content containing a WPML shortcode that reaches the vulnerable Twig render path (typically post or page content where shortcodes are evaluated). No user interaction from an administrator is required (UI:N), the attack is network-reachable over normal HTTP/HTTPS to the WordPress site, and no non-default WPML configuration is needed. Sites that disable open registration and tightly control Contributor accounts materially limit exposure, while sites that allow self-service Contributor sign-up or have many low-trust authors are directly exposed.

Multiple signals converge on high real-world risk. The CVSS 9.9 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates network-reachable, low-complexity exploitation requiring only low privileges with scope change and full CIA impact; EPSS at 73.91% (99th percentile) and publicly available exploit code reinforce that adversaries can readily weaponize the issue. The Contributor-level prerequisite is a meaningful but low bar on sites that allow user registration or guest authoring, and SSTI yielding RCE represents maximum technical impact with high automatability. The vulnerability is not currently listed in CISA KEV, so active exploitation is not confirmed - but with public PoCs and a very high EPSS score, treat this as imminent rather than theoretical. No major conflicting signals were observed in the provided data.

An attacker registers or compromises a Contributor-level WordPress account on a site running WPML <= 4.6.12, then creates or edits a post that embeds a malicious WPML shortcode containing a Twig SSTI payload. When the post is previewed or published and the shortcode is rendered, Twig evaluates the payload server-side and executes attacker-chosen PHP, yielding code execution as the web server user; public PoCs make this scenario directly reproducible by low-skill adversaries.