CVE-2022-25812

Published: Aug 22, 2022Modified: Nov 21, 2024

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not validate its debug settings, which could allow allowing high privilege users such as admin to perform RCE

Affected (1)

Products: Transposh: Transposh Wordpress Translation

Transposh

1 product

Transposh Wordpress Translation

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Transposh Transposh Wordpress Translation	Before 1.0.8

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://wpscan.com/vulnerability/1f6bd346-4743-44b8-86d7-4fbe09bad657

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/1f6bd346-4743-44b8-86d7-4fbe09bad657

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.