Description

WordPress Plugin WPML Translation Management is prone to a vulnerability that lets remote attackers inject and execute arbitrary code because the application fails to sanitize user-supplied input before being passed to the unserialize() PHP function. Attackers can possibly exploit this issue to execute arbitrary PHP code within the context of the affected webserver process. WordPress Plugin WPML Translation Management version 2.4.1 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 2.4.2 or latest

References

https://wpml.org/forums/topic/security-fix/

https://github.com/wp-premium/wpml-translation-management/commit/1901fe0f6f16cfc2e158e0e83066b1d8370bdecd#diff-84b67d3dee9862ebe7a2962a1ff2bc08L252

Related Vulnerabilities

WordPress Plugin Opal Estate Cross-Site Request Forgery (1.6.11)

Dotclear Other Vulnerability (CVE-2005-3963)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-0820)

WordPress Plugin WordPress Email Template Designer-WP HTML Mail Cross-Site Scripting (3.0.9)

SugarCRM Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2023-46816)

Severity

High

Classification

CWE-915 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update