{"api_version":"1","generated_at":"2026-07-23T12:55:51+00:00","cve":"CVE-2022-2462","urls":{"html":"https://cve.report/CVE-2022-2462","api":"https://cve.report/api/cve/CVE-2022-2462.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-2462","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-2462"},"summary":{"title":"Transposh WordPress Translation <= 1.0.9.6 - Sensitive Information Disclosure","description":"The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text.","state":"PUBLISHED","assigner":"Wordfence","published_at":"2022-09-06 18:15:13","updated_at":"2026-04-08 19:17:52"},"problem_types":["CWE-200","CWE-200 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"security@wordfence.com","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","data":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php?rev=2682425#L1948","name":"https://plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php?rev=2682425#L1948","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"title":"403 Forbidden","mime":"text/html","httpstatus":"403","archivestatus":"404"},{"url":"https://packetstormsecurity.com/files/167878/wptransposh1081-disclose.txt","name":"https://packetstormsecurity.com/files/167878/wptransposh1081-disclose.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"Transposh WordPress Translation 1.0.8.1 Information Disclosure ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd1f12ac-86ac-4be9-9575-98381c3b4291?source=cve","name":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd1f12ac-86ac-4be9-9575-98381c3b4291?source=cve","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Transposh WordPress Translation <= 1.0.8.1 - Sensitive Information Disclosure","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/","name":"https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"title":"WordPress Transposh: Exploiting a Blind SQL Injection via XSS - RCE Security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/oferwald/transposh/blob/master/transposh.php#L1550","name":"https://github.com/oferwald/transposh/blob/master/transposh.php#L1550","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2462","name":"https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2462","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"title":"Vulnerability Advisories - Wordfence","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2462","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2462","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"oferwald","product":"Transposh WordPress Translation","version":"affected 1.0.9.6 semver","platforms":[]}],"timeline":[{"source":"CNA","time":"2022-07-18T00:00:00.000Z","lang":"en","value":"Disclosed"}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Julien Ahrens","lang":"en"}],"nvd_cpes":[{"cve_year":"2022","cve_id":"2462","vulnerable":"1","versionEndIncluding":"1.0.8.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"transposh","cpe5":"transposh_wordpress_translation","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2022","cve_id":"2462","cve":"CVE-2022-2462","epss":"0.046570000","percentile":"0.893070000","score_date":"2026-04-08","updated_at":"2026-04-09 00:05:10"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-03T00:39:07.647Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_transferred"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd1f12ac-86ac-4be9-9575-98381c3b4291?source=cve"},{"tags":["x_transferred"],"url":"https://plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php?rev=2682425#L1948"},{"tags":["x_transferred"],"url":"https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2462"},{"tags":["x_transferred"],"url":"https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/"},{"tags":["x_transferred"],"url":"https://packetstormsecurity.com/files/167878/wptransposh1081-disclose.txt"}],"title":"CVE Program Container"},{"metrics":[{"other":{"content":{"id":"CVE-2022-2462","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-10-15T17:29:07.716419Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2024-10-15T18:34:52.936Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Transposh WordPress Translation","vendor":"oferwald","versions":[{"lessThanOrEqual":"1.0.9.6","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Julien Ahrens"}],"descriptions":[{"lang":"en","value":"The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text."}],"metrics":[{"cvssV3_1":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-04-08T17:18:51.712Z","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence"},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bd1f12ac-86ac-4be9-9575-98381c3b4291?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php?rev=2682425#L1948"},{"url":"https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2462"},{"url":"https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/"},{"url":"https://packetstormsecurity.com/files/167878/wptransposh1081-disclose.txt"},{"url":"https://github.com/oferwald/transposh/blob/master/transposh.php#L1550"}],"timeline":[{"lang":"en","time":"2022-07-18T00:00:00.000Z","value":"Disclosed"}],"title":"Transposh WordPress Translation <= 1.0.9.6 - Sensitive Information Disclosure"}},"cveMetadata":{"assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","assignerShortName":"Wordfence","cveId":"CVE-2022-2462","datePublished":"2022-09-06T17:18:57.000Z","dateReserved":"2022-07-18T00:00:00.000Z","dateUpdated":"2026-04-08T17:18:51.712Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2022-09-06 18:15:13","lastModifiedDate":"2026-04-08 19:17:52","problem_types":["CWE-200","CWE-200 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:transposh:transposh_wordpress_translation:*:*:*:*:*:wordpress:*:*","versionEndIncluding":"1.0.8.1","matchCriteriaId":"95C38C84-F714-4FFB-A0A3-2CA8AFB18DA8"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"2462","Ordinal":"1","Title":"Transposh WordPress Translation <= 1.0.9.6 - Sensitive Informati","CVE":"CVE-2022-2462","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"2462","Ordinal":"1","NoteData":"The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text.","Type":"Description","Title":"Transposh WordPress Translation <= 1.0.9.6 - Sensitive Informati"}]}}}