CVE-2022-0770 Translate WordPress with GTranslate < 2.9.9 - CSRF to Account Takeover
An attacker can steal admin cookies via CSRF and debug file exposure to take over accounts in the GTranslate WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-0770?
CVE-2022-0770 is a high-severity vulnerability in Unknown Translate WordPress with GTranslate, published on 28 Mar 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a publicly accessible file if a specific parameter is used when requesting them. Combining those two issues, an attacker could gain access to a logged in admin cookies by making them open a malicious link or page
Weakness: CWE-352
Which versions are affected by CVE-2022-0770?
It affects 1 product.
Products include Gtranslate Translate Wordpress With Gtranslate.
How do I fix CVE-2022-0770?
No fix has been published for CVE-2022-0770 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-0770 being exploited?
There is no known exploitation of CVE-2022-0770 in the wild and no public exploit code.
Other vulnerabilities in Unknown Translate WordPress with GTranslate
Sources
Also known as GHSA-pgcx-vfvx-q6c9.