CVE-2022-2536
Published: 15 December 2022
Summary
CVE-2022-2536 is a medium-severity Improper Authorization (CWE-285) vulnerability in Transposh Transposh Wordpress Translation. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 26.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to and including 1.0.9.6. The issue stems from insufficient validation of settings on the tp_translation AJAX action, which allows bypassing of restrictions that would otherwise control data displayed on the site. This is a distinct flaw from CVE-2022-2461 and arises from faulty logic in wp/transposh_db.php that ignores the configured "Who can translate" option whenever the autotranslate feature is enabled and the sr0 HTTP POST parameter exceeds zero.
Unauthenticated attackers with network access can exploit the vulnerability to influence site content without authentication or user interaction. The CVSS 5.3 rating reflects that the attack requires only low complexity and results in limited integrity impact while leaving confidentiality and availability unaffected.
The EPSS score rose materially from a low baseline to a peak of 0.0784 on 2025-01-22 before receding to the current value of 0.0077, indicating emerging exploitation interest well after the 2022 disclosure. Public references including the researcher's advisory and exploit listings provide technical details on the authorization bypass but do not describe available patches or configuration workarounds.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-34790
Vulnerability details
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient validation of settings on the 'tp_translation' AJAX action which makes it possible…
more
for unauthenticated attackers to bypass any restrictions and influence the data shown on the site. Please note this is a separate issue from CVE-2022-2461. Notes from the researcher: When installed Transposh comes with a set of pre-configured options, one of these is the "Who can translate" setting under the "Settings" tab. However, this option is largely ignored, if Transposh has enabled its "autotranslate" feature (it's enabled by default) and the HTTP POST parameter "sr0" is larger than 0. This is caused by a faulty validation in "wp/transposh_db.php."
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Documented procedures facilitate correct implementation and ongoing management of authorization decisions.
Periodic reviews identify and correct flaws in authorization decisions or enforcement.
The control's documentation requirement reduces improper authorization by ensuring only mission-justified actions bypass authentication.
Establishing permitted attributes and values, plus auditing changes, ensures authorization decisions are based on correctly managed policy data.
Explicitly mandates authorizing remote access types before permitting connections, directly mitigating improper authorization.
The control explicitly requires authorization of each wireless access type prior to permitting connections.
Mandating explicit authorization of mobile device connections reduces the risk of improper authorization decisions for system access.
Specifying access authorizations for each account and requiring approvals for account requests enforces proper authorization decisions.