CVE-2022-2461mediumobserved exploitationCWE-862

CVE-2022-2461: medium-severity vulnerability in oferwald Transposh WordPress Translation

Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change

Published · Updated

Follow this CVE+ Monitor Transposh WordPress Translation

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

50Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 5.3epss 5.1%
from disclosure to weapon
Published on NVDSep 6
VulnCheckJul 25
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
oferwald · Transposh WordPress Translation
Related CVEs — oferwald Transposh WordPress Translation

In the same product, most dangerous first.

CVE-2022-2462MEDIUMTransposh WordPress Translation <= 1.0.9.6 - Sensitive Information DisclosureEPSS 3.8%CVE-2022-2536MEDIUMTransposh WordPress Translation <= 1.0.9.6 - Authorization BypassEPSS 1.5%