I received an email from WP Engine and wanted to share. Is there a fix in progress for this already?
At WP Engine we take the security of your sites very seriously, and make every effort to keep our customers aware of any potential security risks. We are reaching out to you today because we identified your site is utilizing a vulnerable version of the WPML String Translation plugin.
At this time, we are not seeing that the plugin author has released an update or patch for this vulnerability.
WP Engine summary of the vulnerability: The plugin contains a vulnerability wherein unauthenticated visitors could inject SQL statements into WordPress. SQL injection could allow an attacker to gain control of your site.
Original 3rd-party’s report on the vulnerability: Please note that questions related to this article should be directed to the 3rd-party researcher and not WP Engine: hidden link
