Twigify <= 1.1.2 & AP Twig Bridge <= 1.0 & Content Template Engine <= 0.9.4 - Running Vulnerable Twig Package
Strategic Overview
- Status
- Unpatched
- Affected Plugin
- Twigify
- Affected Version
<= 1.1.2- CVSS
- 7.3High
- Weakness type
- CWE-1395 · Dependency on Vulnerable Third-Party Component
- CVE
CVE pending
At a glance
This record tracks a high-severity Dependency on Vulnerable Third-Party Component vulnerability in the Twigify WordPress plugin, affecting versions <= 1.1.2. It carries a CVSS score of 7.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. No fixed release has been reported yet; treat installations running this software as exposed. Disclosed November 2024, reported by Pierre Rudloff.
Vulnerability Overview
The Twigify plugin for WordPress is running a vulnerable version of Twig (1.16.3) in all versions up to, and including, 1.1.2, the AP Twig Bridge plugin for WordPress is running a vulnerable version of Twig (1.5.0) in all versions up to, and including, 1.0, and the Content Template Engine plugin for WordPress is running a vulnerable version of Twig (1.22.3) in all versions up to, and including, 0.9.4. This version of Twig contains many security vulnerabilities, though none have been confirmed exploitable in the Twigify or AP Twig Bridge plugins.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.
CWE-1395: Dependency on Vulnerable Third-Party Component
The product has a dependency on a third-party component that contains one or more known vulnerabilities.
Remediation
No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
How does WordSec protect against this?
No patched version is recorded yet, so there is nothing to update to; WordSec's vulnerability alerts flag this record the moment that changes.
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C