Description

WordPress Plugin WPML Translation Management is prone to a vulnerability that lets remote attackers inject and execute arbitrary code because the application fails to sanitize user-supplied input before being passed to the unserialize() PHP function. Attackers can possibly exploit this issue to execute arbitrary PHP code within the context of the affected webserver process. WordPress Plugin WPML Translation Management version 2.4.1 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 2.4.2 or latest

References

https://wpml.org/forums/topic/security-fix/

https://github.com/wp-premium/wpml-translation-management/commit/1901fe0f6f16cfc2e158e0e83066b1d8370bdecd#diff-84b67d3dee9862ebe7a2962a1ff2bc08L252

Related Vulnerabilities

WordPress Plugin WP Idea Stream Cross-Site Scripting (2.1.1)

WordPress Plugin LearnDash LMS Multiple Information Disclosure Vulnerabilities (4.10.2)

WordPress Plugin WP Affiliate Disclosure Security Bypass (1.1.3)

concrete5 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-5181)

EspoCRM Improper Neutralization of Formula Elements in a CSV File Vulnerability (CVE-2022-38844)

Severity

High

Classification

CWE-915 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update