CVE-2022-2461

🗓️ 06 Sep 2022 17:18:58Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 122 Views🌐 WEB

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated user

Reporter	Title	Published	Views	Family All 23
zdt	Transposh WordPress Translation 1.0.7 Cross Site Scripting Vulnerability	31 Jul 202200:00	–	zdt
zdt	Transposh WordPress Translation 1.0.7 Incorrect Authorization Vulnerability	31 Jul 202200:00	–	zdt
GithubExploit	Exploit for Cross-site Scripting in Astaro Security_Gateway_Software	30 Apr 201915:15	–	githubexploit
attackerkb	CVE-2022-2536	15 Dec 202219:15	–	attackerkb
attackerkb	CVE-2022-2461	6 Sep 202218:15	–	attackerkb
Circl	CVE-2022-2461	16 Sep 202505:39	–	circl
CNNVD	WordPress plugin Transposh WordPress Translation has a security vulnerability	29 Jul 202200:00	–	cnnvd
Cvelist	CVE-2022-2461 Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change	6 Sep 202217:18	–	cvelist
EUVD	EUVD-2022-34722	7 Sep 202200:01	–	euvd
Nuclei	Transposh WordPress Translation <= 1.0.8 - Unauthenticated Settings Change	24 Oct 202602:05	–	nuclei

NVD

Vulners

Node

transposh transposh_wordpress_translationRange≤1.0.8.1wordpress

[
  {
    "vendor": "oferwald",
    "product": "Transposh WordPress Translation",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.0.9.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/167870/wptransposh107-auth.txt
plugins	www.plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php
rcesecurity	www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/
wordfence	www.wordfence.com/vulnerability-advisories/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/223373fc-9d78-47f0-b283-109f8e00b802
exploitalert	www.exploitalert.com/view-details.html

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	Unauthenticated attacker can trigger tp_translation via admin-ajax.php and add translations due to insufficient authorization checks.	CWE-862
ln0	request body	/wp-admin/admin-ajax.php	Unauthenticated attacker can trigger tp_translation via admin-ajax.php and add translations due to insufficient authorization checks.	CWE-862
sr0	request body	/wp-admin/admin-ajax.php	Unauthenticated attacker can trigger tp_translation via admin-ajax.php and add translations due to insufficient authorization checks.	CWE-862
items	request body	/wp-admin/admin-ajax.php	Unauthenticated attacker can trigger tp_translation via admin-ajax.php and add translations due to insufficient authorization checks.	CWE-862
tk0	request body	/wp-admin/admin-ajax.php	Unauthenticated attacker can trigger tp_translation via admin-ajax.php and add translations due to insufficient authorization checks.	CWE-862
tr0	request body	/wp-admin/admin-ajax.php	Unauthenticated attacker can trigger tp_translation via admin-ajax.php and add translations due to insufficient authorization checks.	CWE-862