Authorization Bypass in Polylang Theme and Plugin Translation
CVE-2022-4169

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Theme And Plugin Translation For Polylang (ttfp)
Vendor
CVE Published:
28 November 2022

What is CVE-2022-4169?

The Theme and Plugin Translation for Polylang is susceptible to an authorization bypass vulnerability, leading to potential exploitation by unauthenticated attackers. In versions up to and including 3.2.16, the process_polylang_theme_translation_wp_loaded() function lacks proper capability checks, allowing malicious users to modify translation settings and import translation strings without proper authentication. This can lead to unauthorized changes affecting the integrity of the website's content and translations.

Affected Version(s)

Theme and plugin translation for Polylang (TTfP) * <= 3.2.16

References

https://plugins.trac.wordpress.org/changeset?sfp_email=&s...
https://www.wordfence.com/vulnerability-advisories-contin...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Florent BESNARD
JSON
.