Greeklish-permalink <= 3.3 - Unauthenticated Post Slug Update

The plugin does not implement correct authorization or nonce checks in the cyrtrans_ajax_old AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin’s functionality to change Post slugs either directly or through CSRF.

PoC

1. Create a post with the name “Νέα ανάρτηση”. 2. Visit the post and notice that the permalink uses the Greek characters. 3. In an unauthenticated browser session, run the following code: fetch(‘/wp-admin/admin-ajax.php?action=cyrtrans_ajax_old’, {method: ‘POST’}) 4. Visit the post again, and notice that the permalink now uses Latin characters.