CVE-2022-4169

Katalog CVE

CVSS 5.3 · Medium EPSS 0,72%

Kerentanan Missing Authorization pada theme and plugin translation for polylang project theme and plugin translation for polylang. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks in the process_polylang_theme_translation_wp_loaded() function. This makes it possible for unauthenticated attackers to update plugin and theme translation settings and to import translation strings.

Rincian

Terbit di NVD

28 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,72% peluang dieksploitasi; lebih tinggi dari 52,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2814605%40theme-translation-f... patch · advisory pihak ketiga
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4169 advisory pihak ketiga
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9f6a358a-333c-4eb7-9149-348bf3713943?source=cve