CVE-2024-6386

A security flaw exists in WPML plugin versions prior to 4.6.12 that allows malicious users with contributor or higher permissions to inject arbitrary code into Twig templates via unvalidated input passed to the render function, potentially leading to remote code execution on affected servers. This vulnerability arises from inadequate validation and sanitization of user-submitted data.

Based on public CVE data (MITRE/NVD).