CVE-2022-25810 Transposh WordPress Translation <= 1.0.8 - Subscriber+ Unauthorised Calls

What is CVE-2022-25810?

CVE-2022-25810 is a medium-severity missing authorization vulnerability in Unknown Transposh WordPress Translation, published on 22 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/admin.php?page=tp_utils), which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable this way, which involves resetting configurations and backup/restore operations.

Weakness: CWE-862

Which versions are affected by CVE-2022-25810?

It affects 1 product.

Products include Transposh Transposh Wordpress Translation.

How do I fix CVE-2022-25810?

No fix has been published for CVE-2022-25810 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-25810 being exploited?

There is no known exploitation of CVE-2022-25810 in the wild and no public exploit code.

Other vulnerabilities in Unknown Transposh WordPress Translation

• CVE-2022-25811 Transposh WordPress Translation <= 1.0.8 - Admin+ SQL Injection High 7.2
• CVE-2022-25812 Transposh WordPress Translation < 1.0.8 - Admin+ RCE High 7.2
• CVE-2021-24910 Transposh WordPress Translation < 1.0.8 - Reflected Cross-Site Scripting Medium 6.1
• CVE-2021-24911 Transposh WordPress Translation < 1.0.8 - Stored Cross-Site Scripting Medium 5.4
• CVE-2021-24912 Transposh WordPress Translation < 1.0.8 - CSRF to Stored XSS Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-7j8w-jqvj-386m.