CVE-2020-10568

HIGH EPSS 74.4%
Published Mar 14, 20206y ago · Modified Jun 17, 20261w ago
8.8 CVSS 3.1
High
Find Similar
Published Mar 14, 2020 6y ago
Last Modified Jun 17, 2026 1w ago

Description

The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-installer.php via a series of requests that leverage unintended comparisons of integers to strings.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
74.4% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-352 Cross-Site Request Forgery (CSRF) Authentication

Affected Products 2

VendorProductVersionRange
onthegosystemssitepress-multilingual-cms* <4.3.7
onthegosystemssitepress-multilingual-cms4.3.7any

References 2

  • medium.com https://medium.com/%40arall/sitepress-multilingual-cms-wplugin-wpml-4-3-7-b-2-9c9486c13577
  • wpvulndb.com https://wpvulndb.com/vulnerabilities/10131
    ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.