CVE-2022-2462

🗓️ 06 Sep 2022 17:18:57Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 111 Views🌐 WEB

The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users

Reporter	Title	Published	Views	Family All 18
zdt	Transposh WordPress Translation 1.0.8.1 Information Disclosure Vulnerability	31 Jul 202200:00	–	zdt
GithubExploit	Exploit for Cross-site Scripting in Astaro Security_Gateway_Software	30 Apr 201915:15	–	githubexploit
attackerkb	CVE-2022-2462	6 Sep 202218:15	–	attackerkb
Circl	CVE-2022-2462	6 Sep 202222:19	–	circl
CNNVD	WordPress plugin Transposh WordPress Translation 信息泄露漏洞	29 Jul 202200:00	–	cnnvd
Cvelist	CVE-2022-2462 Transposh WordPress Translation <= 1.0.9.6 - Sensitive Information Disclosure	6 Sep 202217:18	–	cvelist
EUVD	EUVD-2022-34723	3 Oct 202520:07	–	euvd
KittySploit	WordPress Transposh <=1.0.8.1 - Information Disclosure Detection	28 Jul 202611:27	–	kittysploit
Nuclei	WordPress Transposh <=1.0.8.1 - Information Disclosure	15 Oct 202602:05	–	nuclei
NVD	CVE-2022-2462	6 Sep 202218:15	–	nvd

NVD

Vulners

Node

transposh transposh_wordpress_translationRange≤1.0.8.1wordpress

[
  {
    "vendor": "oferwald",
    "product": "Transposh WordPress Translation",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.0.9.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/bd1f12ac-86ac-4be9-9575-98381c3b4291
wordfence	www.wordfence.com/vulnerability-advisories/
packetstormsecurity	www.packetstormsecurity.com/files/167878/wptransposh1081-disclose.txt
plugins	www.plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php
rcesecurity	www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/
github	www.github.com/oferwald/transposh/blob/master/transposh.php

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	Unauthenticated disclosure of translator usernames via tp_history AJAX action.	CWE-200
token	request body	/wp-admin/admin-ajax.php	Unauthenticated disclosure of translator usernames via tp_history AJAX action.	CWE-200
lang	request body	/wp-admin/admin-ajax.php	Unauthenticated disclosure of translator usernames via tp_history AJAX action.	CWE-200

17 Jun 2026 04:41Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.15.3

EPSS0.03718

SSVC

CWE-200