CVE-2022-2461

MEDIUMNuclei

Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-2461 has a selected CVSS score of 5.3 (medium); EIP currently links 1 Nuclei template.

Description

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jul 25, 2022 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 23, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Transposh WordPress Translation

Browse oferwald / Transposh WordPress Translation

Default status: unaffected

CVE ListThrough 1.0.9.6affected

transposh_wordpress_translation

Browse transposh / transposh_wordpress_translation
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMTransposh WordPress Translation <= 1.0.8 - Unauthenticated Settings ChangeCVSS 5.3

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.8.1. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.

Impact

Unauthenticated attackers can modify plugin settings through the tp_translation AJAX endpoint without authentication, potentially manipulating translated content and injecting malicious data that affects all site visitors.

Remediation

Update Transposh WordPress Translation plugin to a version newer than 1.0.8.1 that implements proper authentication checks on AJAX actions.

WeaknessesCWE-862
Authorsriteshs4hu
Template tagscvecve2022wordpresswp-pluginwpwpscantransposh-translation-filter-for-wordpressinfo-leakvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CPE: cpe:2.3:a:transposh:transposh_wordpress_translation:*:*:*:*:*:wordpress:*:*
FOFA: body="/wp-content/plugins/transposh-translation-filter-for-wordpress/"
https://wpscan.com/vulnerability/56a961b0-66b7-4dbf-a0e4-0cd38c9aa8dd/ https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2022-2461.txt https://www.wordfence.com/threat-intel/vulnerabilities/id/223373fc-9d78-47f0-b283-109f8e00b802?source=cve https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2461

Source: ProjectDiscovery

References

7