CODE EXECUTION VULNERABILITY FOUND IN WPML PLUGIN INSTALLED ON 1M WORDPRESS SITES

Summary from the TLDR InfoSec newsletter

A critical vulnerability (CVE-2024-6386) in the WPML WordPress plugin could allow remote code execution on over one million websites. The flaw stems from improper input sanitization in Twig templates. A proof-of-concept is available for the vulnerability. Users should update to WPML version 4.6.13 immediately.