| Package | Affected versions | Patched versions |
|---|---|---|
| sitepress-multilingual-cms | = 4.3.7< 4.3.7 | 4.3.7 |
The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-installer.php via a series of requests that leverage unintended comparisons of integers to strings.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free