CVE-2022-2462

🗓️ 06 Sep 2022 17:18:57Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 82 Views🌐 WEB

The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users

Reporter	Title	Published	Views	Family All 17
0day.today	Transposh WordPress Translation 1.0.8.1 Information Disclosure Vulnerability	31 Jul 202200:00	–	zdt
GithubExploit	Exploit for Cross-site Scripting in Astaro Security_Gateway_Software	30 Apr 201915:15	–	githubexploit
ATTACKERKB	CVE-2022-2462	6 Sep 202218:15	–	attackerkb
Circl	CVE-2022-2462	6 Sep 202222:19	–	circl
CNNVD	WordPress plugin Transposh WordPress Translation 信息泄露漏洞	29 Jul 202200:00	–	cnnvd
Cvelist	CVE-2022-2462 Transposh WordPress Translation <= 1.0.9.6 - Sensitive Information Disclosure	6 Sep 202217:18	–	cvelist
EUVD	EUVD-2022-34723	3 Oct 202520:07	–	euvd
Nuclei	WordPress Transposh <=1.0.8.1 - Information Disclosure	7 Jun 202603:02	–	nuclei
NVD	CVE-2022-2462	6 Sep 202218:15	–	nvd
OSV	CVE-2022-2462	6 Sep 202218:15	–	osv

NVD

Vulners

Node

transposh transposh_wordpress_translationRange≤1.0.8.1wordpress

[
  {
    "vendor": "oferwald",
    "product": "Transposh WordPress Translation",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.0.9.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/bd1f12ac-86ac-4be9-9575-98381c3b4291
rcesecurity	www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/
packetstormsecurity	www.packetstormsecurity.com/files/167878/wptransposh1081-disclose.txt
wordfence	www.wordfence.com/vulnerability-advisories/
github	www.github.com/oferwald/transposh/blob/master/transposh.php

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	Exposed tp_history AJAX endpoint allows unauthenticated users to retrieve translator usernames via token, leaking sensitive information.	CWE-200
token	request body	/wp-admin/admin-ajax.php	Exposed tp_history AJAX endpoint allows unauthenticated users to retrieve translator usernames via token, leaking sensitive information.	CWE-200
lang	request body	/wp-admin/admin-ajax.php	Exposed tp_history AJAX endpoint allows unauthenticated users to retrieve translator usernames via token, leaking sensitive information.	CWE-200

08 Apr 2026 19:17Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.15.3

EPSS0.02615

SSVC

CWE-200