blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-2536

MEDIUM 5.3 CVSS 3.1
Published
December 15, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@wordfence.com
Weakness
CWE-285
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient validation of settings on the 'tp_translation' AJAX action which makes it possible for unauthenticated attackers to bypass any restrictions and influence the data shown on the site. Please note this is a separate issue from CVE-2022-2461. Notes from the researcher: When installed Transposh comes with a set of pre-configured options, one of these is the "Who can translate" setting under the "Settings" tab. However, this option is largely ignored, if Transposh has enabled its "autotranslate" feature (it's enabled by default) and the HTTP POST parameter "sr0" is larger than 0. This is caused by a faulty validation in "wp/transposh_db.php."

Affected WordPress components

  • transposh-translation-filter-for-wordpress Plugin · transposh-translation-filter-for-wordpress
    Confirmed match Homeless
    Up to and including 1.0.9.6
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • oferwald Transposh WordPress Translation — Up to and including 1.0.9.6
  • transposh transposh_wordpress_translation — Up to and including 1.0.8.1

References

  • github.com https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2022-2536.txt Exploit, Third Party Advisory
  • packetstormsecurity.com https://packetstormsecurity.com/files/168120/wptransposh1081-authz.txt Exploit, Third Party Advisory, VDB Entry
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php?rev=2682425#L1989 Exploit, Third Party Advisory
  • www.exploitalert.com https://www.exploitalert.com/view-details.html?id=38949 Exploit, Third Party Advisory
  • www.rcesecurity.com https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/ Not Applicable
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/c774b520-9d9f-4102-8564-49673d5ae1e6?source=cve
  • www.wordfence.com https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-2536 Third Party Advisory
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/c774b520-9d9f-4102-8564-49673d5ae1e6 Third Party Advisory
  • nvd.nist.gov Official NVD record