{"api_version":"1","generated_at":"2026-07-24T19:58:39+00:00","cve":"CVE-2022-2461","urls":{"html":"https://cve.report/CVE-2022-2461","api":"https://cve.report/api/cve/CVE-2022-2461.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-2461","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-2461"},"summary":{"title":"Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change","description":"The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.","state":"PUBLISHED","assigner":"Wordfence","published_at":"2022-09-06 18:15:13","updated_at":"2026-04-08 17:16:45"},"problem_types":["CWE-862","CWE-862 CWE-862 Missing Authorization"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"security@wordfence.com","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","data":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://www.exploitalert.com/view-details.html?id=38891","name":"https://www.exploitalert.com/view-details.html?id=38891","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"title":"Transposh WordPress Translation 1.0.7 Incorrect Authorization - Exploitalert","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2461","name":"https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2461","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Vulnerability Advisories - Wordfence","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://packetstormsecurity.com/files/167870/wptransposh107-auth.txt","name":"https://packetstormsecurity.com/files/167870/wptransposh107-auth.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"Transposh WordPress Translation 1.0.7 Incorrect Authorization ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/","name":"https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"title":"WordPress Transposh: Exploiting a Blind SQL Injection via XSS - RCE Security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php?rev=2682425#L1989","name":"https://plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php?rev=2682425#L1989","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"title":"403 Forbidden","mime":"text/html","httpstatus":"403","archivestatus":"404"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/223373fc-9d78-47f0-b283-109f8e00b802?source=cve","name":"https://www.wordfence.com/threat-intel/vulnerabilities/id/223373fc-9d78-47f0-b283-109f8e00b802?source=cve","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Transposh WordPress Translation <= 1.0.8.1 - Unauthorized Settings Change","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2461","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2461","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"oferwald","product":"Transposh WordPress Translation","version":"affected 1.0.9.6 semver","platforms":[]}],"timeline":[{"source":"CNA","time":"2022-07-18T00:00:00.000Z","lang":"en","value":"Disclosed"}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Julien Ahrens","lang":"en"}],"nvd_cpes":[{"cve_year":"2022","cve_id":"2461","vulnerable":"1","versionEndIncluding":"1.0.8.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"transposh","cpe5":"transposh_wordpress_translation","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-03T00:39:07.801Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_transferred"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/223373fc-9d78-47f0-b283-109f8e00b802?source=cve"},{"tags":["x_transferred"],"url":"https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2461"},{"tags":["x_transferred"],"url":"https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/"},{"tags":["x_transferred"],"url":"https://plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php?rev=2682425#L1989"},{"tags":["x_transferred"],"url":"https://packetstormsecurity.com/files/167870/wptransposh107-auth.txt"},{"tags":["x_transferred"],"url":"https://www.exploitalert.com/view-details.html?id=38891"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2022-2461","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-04-23T13:17:43.818829Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-05-05T16:18:40.559Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Transposh WordPress Translation","vendor":"oferwald","versions":[{"lessThanOrEqual":"1.0.9.6","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Julien Ahrens"}],"descriptions":[{"lang":"en","value":"The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site."}],"metrics":[{"cvssV3_1":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-04-08T16:41:36.744Z","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence"},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/223373fc-9d78-47f0-b283-109f8e00b802?source=cve"},{"url":"https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2461"},{"url":"https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/"},{"url":"https://plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php?rev=2682425#L1989"},{"url":"https://packetstormsecurity.com/files/167870/wptransposh107-auth.txt"},{"url":"https://www.exploitalert.com/view-details.html?id=38891"}],"timeline":[{"lang":"en","time":"2022-07-18T00:00:00.000Z","value":"Disclosed"}],"title":"Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change"}},"cveMetadata":{"assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","assignerShortName":"Wordfence","cveId":"CVE-2022-2461","datePublished":"2022-09-06T17:18:58.000Z","dateReserved":"2022-07-18T00:00:00.000Z","dateUpdated":"2026-04-08T16:41:36.744Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2022-09-06 18:15:13","lastModifiedDate":"2026-04-08 17:16:45","problem_types":["CWE-862","CWE-862 CWE-862 Missing Authorization"],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:transposh:transposh_wordpress_translation:*:*:*:*:*:wordpress:*:*","versionEndIncluding":"1.0.8.1","matchCriteriaId":"95C38C84-F714-4FFB-A0A3-2CA8AFB18DA8"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"2461","Ordinal":"1","Title":"Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settin","CVE":"CVE-2022-2461","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"2461","Ordinal":"1","NoteData":"The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.","Type":"Description","Title":"Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settin"}]}}}