CVE-2022-2461 Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change

What is CVE-2022-2461?

CVE-2022-2461 is a medium-severity missing authorization vulnerability in oferwald Transposh WordPress Translation, published on 6 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.

Weakness: CWE-862

Which versions are affected by CVE-2022-2461?

It affects 1 product.

Products include Transposh Transposh Wordpress Translation.

How do I fix CVE-2022-2461?

No fix has been published for CVE-2022-2461 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-2461 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2461 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in oferwald Transposh WordPress Translation

• CVE-2022-25811 Transposh WordPress Translation <= 1.0.8 - Admin+ SQL Injection High 7.2
• CVE-2022-25812 Transposh WordPress Translation < 1.0.8 - Admin+ RCE High 7.2
• CVE-2022-25810 Transposh WordPress Translation <= 1.0.8 - Subscriber+ Unauthorised Calls Medium 6.5
• CVE-2021-24910 Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site Scripting Medium 6.1
• CVE-2021-24911 Transposh WordPress Translation < 1.0.8 - Stored Cross-Site Scripting Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3xc8-4p8r-q7hj.