Transposh WordPress Translation 1.0.7 Incorrect Authorization
Posted by deepcore on July 30, 2022 – 7:26 pm
Transposh WordPress Translation versions 1.0.7 and below suffer from an incorrect authorization vulnerability. When installed, Transposh comes with a set of pre-configured options, one of these is the “Who can translate” setting under the “Settings” tab, which by default allows “Anonymous” users to add translations via the plugin’s “tp_translation” ajax action. Successful exploits can allow an unauthenticated attacker to add translations to the WordPress site and thereby influence what is actually shown on the site.
Post a reply
You must be logged in to post a comment.