CVE-2022-2461

MEDIUM EXPLOITED NUCLEI

Transposh WordPress Translation <= 1.0.9.6 - Unauthenticated Setting Change via tp_translation AJAX Action

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-2461 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.

Nuclei Templates (1)

Transposh WordPress Translation <= 1.0.8 - Unauthenticated Settings Change
MEDIUMVERIFIEDby riteshs4hu
FOFA: body="/wp-content/plugins/transposh-translation-filter-for-wordpress/"

References (6)

Core 6

Scores

CVSS v3 5.3
EPSS 0.0351
EPSS Percentile 87.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

VulnCheck KEV 2022-07-25
CWE
CWE-862
Status published
Products (2)
oferwald/Transposh WordPress Translation < 1.0.9.6
transposh/transposh_wordpress_translation < 1.0.8.1
Published Sep 06, 2022
Tracked Since Feb 18, 2026