+44 0330 223 3428
Call Us
+44 0330 223 3428

WPTavern: WPML Website Hacked, Customer Emails Compromised

WPTavern: WPML Website Hacked, Customer Emails Compromised

On Saturday, January 19, WPML customers started reporting having received an email from someone who seems to have hacked the plugin’s website and gained access to customer information.

The hacker claims to be a disgruntled customer who had two websites hacked due to vulnerabilities in the WPML plugin:

WPML came with a bunch of ridiculous security holes which, despite my efforts to keep everything up to date, allowed the most important two of my websites to be hacked.

WPML exposed sensitive information to someone with very little coding skills but merely with access to the WPML code and some interest in seeing how easy is to break it.

I’m able to write this here because of the very same WPML flaws as this plugin is used on wpml.org too.

The hacker also claims to have exploited the same vulnerabilities in order to send the email to WPML’s customers and has published the same message to the plugin’s website. The text is still live at this time and product pages have also been defaced.

The commercial multilingual plugin has been in business since 2009 and is active on more than 600,000 WordPress sites. It is a popular plugin for business sites in Europe, North America, Asia, and South America, especially those with a global audience. Customers are still waiting for an official explanation from WPML.

We contacted the company for comment but have not yet received a response. If you are using the plugin, you should deactivate it until the company pushes an update to patch the security vulnerabilities. This story is developing and we will publish new information as it becomes available.

Update from WPML founder Amir Helzer: “The customer is an ex-employee who left an exploit on the server (not WPML plugin) before leaving. Besides fixing the damage, we’ll also be taking legal actions.”


On Saturday, January 19, WPML customers started reporting having received an email from someone who seems to have hacked the plugin’s website and gained access to customer information. Got same mail and there is this text on #wpml website visible now. What happened guys? #security #hack #vulnerability #0day or something? #WordPress — Gytis Repečka (@gytisrepecka) January 19, 2019 The hacker claims to be a disgruntled customer who had two websites hacked due to vulnerabilities in the WPML plugin: WPML came with a bunch of ridiculous security holes which, despite my efforts to keep everything up to date, allowed the most…

Source: WordPress

Related Post
WPTavern: WPWeekly Episode 349 – Sandy Edwards and the Kids Event Working Group Initiative

WPTavern: WPWeekly Episode 349 – Sandy Edwards and the Kids Event Working Group Initiative In this episode, John James Jacoby and I are joined by Sandy Edwards. Sandy gave us a behind the scenes look at what it takes to organize a WordPress event for children and teens. She also provides background information on a […]

Read more
WPTavern: WordPress Ends Support for PHP 5.2 – 5.5, Bumps Minimum Required PHP Version to 5.6

WPTavern: WordPress Ends Support for PHP 5.2 – 5.5, Bumps Minimum Required PHP Version to 5.6 WordPress has officially ended support for PHP 5.2 – 5.5 and bumped its minimum required PHP version to 5.6. The plan announced last December was to bump the minimum required version in early 2019 and, depending on the results, […]

Read more
WPTavern: Gutenberg 5.3 Introduces Block Management, Adds Nesting to the Cover Block

WPTavern: Gutenberg 5.3 Introduces Block Management, Adds Nesting to the Cover Block Gutenberg 5.3 was released today with basic block management, a feature that will be included in WordPress 5.2. It is a new modal that can be launched from the vertical ellipses menu, inspired by Rich Tabor’s CoBlocks implementation. Users can turn individual blocks […]

Read more