CVE-2022-2536

🗓️ 15 Dec 2022 04:01:45Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 112 Views🌐 WEB

The Transposh WordPress Translation plugin is vulnerable to unauthorized setting changes by unauthenticated users

Reporter	Title	Published	Views	Family All 17
zdt	Transposh WordPress Translation 1.0.8.1 Incorrect Authorization Vulnerability	22 Aug 202200:00	–	zdt
GithubExploit	Exploit for Cross-site Scripting in Astaro Security_Gateway_Software	30 Apr 201915:15	–	githubexploit
attackerkb	CVE-2022-2536	15 Dec 202219:15	–	attackerkb
Circl	CVE-2022-2536	1 Sep 202620:01	–	circl
CNNVD	WordPress plugin transposh-translation-filter-for-wordpress authorization issue vulnerability	19 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-2536 Transposh WordPress Translation <= 1.0.9.6 - Authorization Bypass	15 Dec 202204:01	–	cvelist
EUVD	EUVD-2022-34790	3 Oct 202520:07	–	euvd
NVD	CVE-2022-2536	15 Dec 202219:15	–	nvd
osv_cve	CVE-2022-2536	15 Dec 202219:15	–	osv_cve
Packet Storm	Transposh WordPress Translation 1.0.8.1 Incorrect Authorization	19 Aug 202200:00	–	packetstorm

NVD

Vulners

Node

transposh transposh_wordpress_translationRange≤1.0.8.1wordpress

[
  {
    "vendor": "oferwald",
    "product": "Transposh WordPress Translation",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.0.9.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/168120/wptransposh1081-authz.txt
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/c774b520-9d9f-4102-8564-49673d5ae1e6
wordfence	www.wordfence.com/vulnerability-advisories-continued/
plugins	www.plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php
rcesecurity	www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/
github	www.github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2022-2536.txt
exploitalert	www.exploitalert.com/view-details.html
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/c774b520-9d9f-4102-8564-49673d5ae1e6

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	Unauthenticated attackers can bypass Transposh permissions to add translations to a WordPress site by sending a POST request to the AJAX handler with the 'tp_translation' action and an 'sr0' parameter greater than 0.	CWE-863
ln0	request body	/wp-admin/admin-ajax.php	Unauthenticated attackers can bypass Transposh permissions to add translations to a WordPress site by sending a POST request to the AJAX handler with the 'tp_translation' action and an 'sr0' parameter greater than 0.	CWE-863
sr0	request body	/wp-admin/admin-ajax.php	Unauthenticated attackers can bypass Transposh permissions to add translations to a WordPress site by sending a POST request to the AJAX handler with the 'tp_translation' action and an 'sr0' parameter greater than 0.	CWE-863
items	request body	/wp-admin/admin-ajax.php	Unauthenticated attackers can bypass Transposh permissions to add translations to a WordPress site by sending a POST request to the AJAX handler with the 'tp_translation' action and an 'sr0' parameter greater than 0.	CWE-863
tk0	request body	/wp-admin/admin-ajax.php	Unauthenticated attackers can bypass Transposh permissions to add translations to a WordPress site by sending a POST request to the AJAX handler with the 'tp_translation' action and an 'sr0' parameter greater than 0.	CWE-863
tr0	request body	/wp-admin/admin-ajax.php	Unauthenticated attackers can bypass Transposh permissions to add translations to a WordPress site by sending a POST request to the AJAX handler with the 'tp_translation' action and an 'sr0' parameter greater than 0.	CWE-863

17 Jun 2026 04:42Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.15.3 - 7.5

EPSS0.01451

SSVC

CWE-285