writeups.xyz / WPML Multilingual CMS Authenticated Contributor+ Remote Code Execution (RCE) via Twig Server-Side Template Injection (SSTI)

Submitter : c2a

Date: 21 August 2024

Bounty : 1,639

Vulnerabilities :

• SSTI
• RCE
• Security Code Review

Programs :

• Wordfence

Authors :

• Matthew Rollings (@Stealthcopter)

Link :
https://sec.stealthcopter.com/wpml-rce-via-twig-ssti/