CVE-2022-2462 Transposh WordPress Translation <= 1.0.9.6 - Sensitive Information Disclosure

What is CVE-2022-2462?

CVE-2022-2462 is a medium-severity vulnerability in oferwald Transposh WordPress Translation, published on 6 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text.

Weakness: CWE-200

Which versions are affected by CVE-2022-2462?

It affects 1 product.

Products include Transposh Transposh Wordpress Translation.

How do I fix CVE-2022-2462?

No fix has been published for CVE-2022-2462 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-2462 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2462 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in oferwald Transposh WordPress Translation

• CVE-2022-25811 Transposh WordPress Translation <= 1.0.8 - Admin+ SQL Injection High 7.2
• CVE-2022-25812 Transposh WordPress Translation < 1.0.8 - Admin+ RCE High 7.2
• CVE-2022-25810 Transposh WordPress Translation <= 1.0.8 - Subscriber+ Unauthorised Calls Medium 6.5
• CVE-2021-24910 Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site Scripting Medium 6.1
• CVE-2021-24911 Transposh WordPress Translation < 1.0.8 - Stored Cross-Site Scripting Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vr73-3j55-m4ww.