MalCare Proactively Blocks Remote Code Execution Exploits in WPML Plugin

On June 19th, 2024, a critical security flaw was discovered in the WPML WordPress plugin, affecting all versions up to 4.6.12. This vulnerability is severe, as it allows attackers to execute harmful code on your site, potentially taking full control.

If you use this plugin, scan your site immediately to check for any issues.

What is the vulnerability?

With over 1,000,000 active installs, WPML is a widely used plugin for creating and managing translations on multilingual WordPress websites. However, versions 4.6.12 and earlier have a severe vulnerability that permits a Contributor-level user to execute malicious code on the server.

In simple terms, someone with basic access could run malware on your site server without your knowledge. This is known as remote code execution (RCE) via server-side template injection (SSTI).

Should you be worried?

The vulnerability has been assigned a CVSS score of 9.9 (Critical), which indicates a severe risk of complete site compromise.

This vulnerability allows authenticated attackers with Contributor-level access or higher to execute arbitrary code on the server. This could lead to an attacker installing malicious plugins, altering your site’s content, or even taking full control of your site.

MalCare protection

If you are a MalCare user, here’s how MalCare has protected your site:

1. You’ve been notified: We alerted all sites using the vulnerable WPML plugin.

2. Your site is secured: Our smart Atomic Security firewall has already blocked any attempts to exploit this vulnerability.

Atomic Security enhances WordPress safety by guarding against common attack points. It automatically blocks new threats without requiring any action from you.

What should you do next?

1. Update your plugin: Immediately update the WPML plugin to version 4.6.13 or higher, which contains the patch to address this critical vulnerability.

2. Check for compromise: To check if your site has been compromised, look for unusual activity, unauthorized changes, or unknown plugins.

3. Steps if compromised: If you suspect your site has been compromised, follow these steps:

Technical details of the vulnerability

The vulnerability in WPML stems from the way it handles Twig templates. Twig is a popular PHP template engine that allows users to modify template designs. This engine, however, had an SSTI vulnerability. An SSTI vulnerability allows attackers to inject malicious payloads into templates, which would then be executed by the server. In this case, Twig’s template syntax could be used to inject harmful commands.

Here’s a deeper dive for those technically inclined:

Issue: The problem is with the WPML plugin for WordPress up to version 4.6.12. It happens when the render() function is used with the [wpml_language_switcher] shortcode. This function shows Twig templates, which attackers can use to run harmful code on the server.

Root cause: The root cause is the lack of proper input checks and cleaning in the render() function. Twig’s built-in functions and filters, like array_filter() for calling different functions, can be misused by attackers to inject and run bad code.

Timeline

How MalCare’s protection works

MalCare’s Atomic Security firewall blocks these vulnerabilities proactively. It uses a signal-based method to identify issues rather than relying on samples. This way, it smartly prevents attempts to exploit similar vulnerabilities. Unlike traditional methods, it doesn’t wait for an alarm to respond but detects and stops suspicious behavior immediately. This AI-powered approach is essential in today’s rapidly changing threat landscape.

General protection advice

1. Always keep your plugins, themes, and WordPress core updated to the latest versions.

2. Use complex passwords and change them regularly to minimize the risk of brute-force attacks.

3. Add comprehensive security plugins such as MalCare to monitor and protect your site continuously.

4. Maintain regular backups of your site, so you can easily restore it in case of an attack.

By understanding the critical nature of this vulnerability and taking immediate action, you can ensure the safety and integrity of your WordPress site.