The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Published: 2024-08-21

CVSS: 9.9

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Download Exploit for CVE-2024-6386 here:

Use Tor Browser to access .onion links.

Check our team here:

https://tatramed.sk/exploit-1068-cve-2025-27515/

https://tatramed.sk/exploit-241-cve-2025-11021/

https://tatramed.sk/exploit-898-cve-2021-30116/

https://tatramed.sk/exploit-961-cve-2021-32790/