Unauthorized Setting Changes in Transposh WordPress Translation Plugin
CVE-2022-2536

7.5HIGH

Key Information:

Vendor
Wordpress
Status
Transposh WordPress Translation
Vendor
CVE Published:
15 December 2022

Summary

The Transposh WordPress Translation plugin is impacted by a vulnerability that allows unauthenticated users to modify site settings unchecked. This occurs due to inadequate validation on the 'tp_translation' AJAX action. Attackers can exploit this weakness to override the 'Who can translate' option, particularly when the plugin's auto-translate feature is enabled by default. This security flaw enables unauthorized manipulation of displayed data, raising significant concerns for the integrity of WordPress websites using the plugin.

Affected Version(s)

Transposh WordPress Translation * <= 1.0.8.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://www.rcesecurity.com/2022/07/WordPress-Transposh-E...
https://plugins.trac.wordpress.org/browser/transposh-tran...

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Julien Ahrens
.