CVE-2022-2461

🗓️ 06 Sep 2022 17:18:58Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 81 Views🌐 WEB

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated user

Reporter	Title	Published	Views	Family All 22
0day.today	Transposh WordPress Translation 1.0.7 Cross Site Scripting Vulnerability	31 Jul 202200:00	–	zdt
0day.today	Transposh WordPress Translation 1.0.7 Incorrect Authorization Vulnerability	31 Jul 202200:00	–	zdt
GithubExploit	Exploit for Cross-site Scripting in Astaro Security_Gateway_Software	30 Apr 201915:15	–	githubexploit
ATTACKERKB	CVE-2022-2536	15 Dec 202219:15	–	attackerkb
ATTACKERKB	CVE-2022-2461	6 Sep 202218:15	–	attackerkb
Circl	CVE-2022-2461	16 Sep 202505:39	–	circl
CNNVD	WordPress plugin Transposh WordPress Translation 安全漏洞	29 Jul 202200:00	–	cnnvd
Cvelist	CVE-2022-2461 Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change	6 Sep 202217:18	–	cvelist
EUVD	EUVD-2022-34722	7 Sep 202200:01	–	euvd
Nuclei	Transposh WordPress Translation <= 1.0.8 - Unauthenticated Settings Change	4 Jun 202603:48	–	nuclei

NVD

Vulners

Node

transposh transposh_wordpress_translationRange≤1.0.8.1wordpress

[
  {
    "vendor": "oferwald",
    "product": "Transposh WordPress Translation",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.0.9.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php
wordfence	www.wordfence.com/vulnerability-advisories/
packetstormsecurity	www.packetstormsecurity.com/files/167870/wptransposh107-auth.txt
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/223373fc-9d78-47f0-b283-109f8e00b802
rcesecurity	www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/
exploitalert	www.exploitalert.com/view-details.html

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	Unauthenticated users can trigger the tp_translation AJAX action to add translations, due to insufficient permission checks.	CWE-862
ln0	request body	/wp-admin/admin-ajax.php	Unauthenticated users can trigger the tp_translation AJAX action to add translations, due to insufficient permission checks.	CWE-862
sr0	request body	/wp-admin/admin-ajax.php	Unauthenticated users can trigger the tp_translation AJAX action to add translations, due to insufficient permission checks.	CWE-862
items	request body	/wp-admin/admin-ajax.php	Unauthenticated users can trigger the tp_translation AJAX action to add translations, due to insufficient permission checks.	CWE-862
tk0	request body	/wp-admin/admin-ajax.php	Unauthenticated users can trigger the tp_translation AJAX action to add translations, due to insufficient permission checks.	CWE-862
tr0	request body	/wp-admin/admin-ajax.php	Unauthenticated users can trigger the tp_translation AJAX action to add translations, due to insufficient permission checks.	CWE-862