Vulnerability Description
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Transposh | Transposh Wordpress Translation | <= 1.0.8.1 |
Related Weaknesses (CWE)
References
- https://packetstormsecurity.com/files/167870/wptransposh107-auth.txtExploitThird Party AdvisoryVDB Entry
- https://plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordPatchThird Party Advisory
- https://www.exploitalert.com/view-details.html?id=38891ExploitThird Party Advisory
- https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-IExploitThird Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/223373fc-9d78-47f0-b28Third Party Advisory
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2461Third Party Advisory
- https://packetstormsecurity.com/files/167870/wptransposh107-auth.txtExploitThird Party AdvisoryVDB Entry
- https://plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordPatchThird Party Advisory
- https://www.exploitalert.com/view-details.html?id=38891ExploitThird Party Advisory
- https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-IExploitThird Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/223373fc-9d78-47f0-b28Third Party Advisory
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2461Third Party Advisory
FAQ
What is CVE-2022-2461?
CVE-2022-2461 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient p...
How severe is CVE-2022-2461?
CVE-2022-2461 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-2461?
Check the references section above for vendor advisories and patch information. Affected products include: Transposh Transposh Wordpress Translation.