CVE-2022-2461

Katalog CVE

CVSS 5.3 · Medium EPSS 4,8%

Kerentanan Missing Authorization pada transposh wordpress translation. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.

Rincian

Terbit di NVD

6 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

4,8% peluang dieksploitasi; lebih tinggi dari 91,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php?rev=... patch · advisory pihak ketiga
• https://packetstormsecurity.com/files/167870/wptransposh107-auth.txt exploit · advisory pihak ketiga · vdb entry
• https://www.exploitalert.com/view-details.html?id=38891 exploit · advisory pihak ketiga
• https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/ exploit · advisory pihak ketiga
• https://www.wordfence.com/threat-intel/vulnerabilities/id/223373fc-9d78-47f0-b283-109f8e00b802?source=cve advisory pihak ketiga
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2461 advisory pihak ketiga