Collected research

The Full Story of CVE-2024-6386: Remote Code Execution in WPML

Jonas Lejon and @wpscans · WPSec · 17 December 2024

Explains how a contributor-level user could reach WPML's Twig shortcode rendering and obtain server-side template injection. Quote-free string construction bypasses the surrounding syntax constraints and turns the injection into remote code execution.

Record

Researcher

Jonas Lejon and @wpscans

Published by

WPSec

Date

17 December 2024

In the archive

• Collected in the 2024 research round

Tags

• wordpress
• ssti
• rce
• filter-bypass
• php
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Jonas Lejon and @wpscans, first published at the original source. Preserved copies are kept so the citation survives its host.