CVE-2022-2536

🗓️ 15 Dec 2022 04:01:45Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 82 Views🌐 WEB

The Transposh WordPress Translation plugin is vulnerable to unauthorized setting changes by unauthenticated users

Reporter	Title	Published	Views	Family All 15
0day.today	Transposh WordPress Translation 1.0.8.1 Incorrect Authorization Vulnerability	22 Aug 202200:00	–	zdt
GithubExploit	Exploit for Cross-site Scripting in Astaro Security_Gateway_Software	30 Apr 201915:15	–	githubexploit
ATTACKERKB	CVE-2022-2536	15 Dec 202219:15	–	attackerkb
CNNVD	WordPress plugin transposh-translation-filter-for-wordpress 授权问题漏洞	19 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-2536 Transposh WordPress Translation <= 1.0.9.6 - Authorization Bypass	15 Dec 202204:01	–	cvelist
EUVD	EUVD-2022-34790	3 Oct 202520:07	–	euvd
NVD	CVE-2022-2536	15 Dec 202219:15	–	nvd
OSV	CVE-2022-2536	15 Dec 202219:15	–	osv
Packet Storm	Transposh WordPress Translation 1.0.8.1 Incorrect Authorization	19 Aug 202200:00	–	packetstorm
Patchstack	WordPress Transposh WordPress Translation plugin <= 1.0.8.1 - Authorization Bypass vulnerability	14 Nov 202200:00	–	patchstack

NVD

Vulners

Node

transposh transposh_wordpress_translationRange≤1.0.8.1wordpress

[
  {
    "vendor": "oferwald",
    "product": "Transposh WordPress Translation",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.0.9.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/168120/wptransposh1081-authz.txt
github	www.github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2022-2536.txt
rcesecurity	www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/
exploitalert	www.exploitalert.com/view-details.html
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/c774b520-9d9f-4102-8564-49673d5ae1e6
plugins	www.plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php
wordfence	www.wordfence.com/vulnerability-advisories-continued/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/c774b520-9d9f-4102-8564-49673d5ae1e6

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	Authorization bypass via Transposh tp_translation when sr0>0 allowing unauthenticated translation changes	CWE-285
ln0	request body	/wp-admin/admin-ajax.php	Authorization bypass via Transposh tp_translation when sr0>0 allowing unauthenticated translation changes	CWE-285
sr0	request body	/wp-admin/admin-ajax.php	Authorization bypass via Transposh tp_translation when sr0>0 allowing unauthenticated translation changes	CWE-285
items	request body	/wp-admin/admin-ajax.php	Authorization bypass via Transposh tp_translation when sr0>0 allowing unauthenticated translation changes	CWE-285
tk0	request body	/wp-admin/admin-ajax.php	Authorization bypass via Transposh tp_translation when sr0>0 allowing unauthenticated translation changes	CWE-285
tr0	request body	/wp-admin/admin-ajax.php	Authorization bypass via Transposh tp_translation when sr0>0 allowing unauthenticated translation changes	CWE-285

17 Jun 2026 04:42Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.15.3 - 7.5

EPSS0.01369

SSVC

CWE-285