CVE-2022-25810

CVE-2022-25810: Transposh WordPress Translation <= 1.0.8 - Subscriber+ Unauthorised Calls

Vendor Unknown

Product Transposh WordPress Translation

Weakness CWE-862 · Missing authorization

Published August 22, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Transposh WordPress Translation WordPress plugin through 1.0.8 exposes a couple of sensitive actions such has “tp_reset” under the Utilities tab (/wp-admin/admin.php?page=tp_utils), which can be used/executed as the lowest-privileged user. Basically all Utilities functionalities are vulnerable this way, which involves resetting configurations and backup/restore operations.

Key dates

02Disclosure timeline

August 22, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-25810 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html AskarLabs — CWE-862 write-up Missing Authorization

Related vulnerabilities

04Related CVE

CVE-2026-65479 WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability CVE-2026-59522 WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability CVE-2026-15397 Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action CVE-2026-65491 WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability CVE-2026-65453 WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability