High severity · published Mar 28, 2022
CVE-2022-0770
The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a publicly accessible…
8.8
CVSS
0.6%
EPSS
No
On KEV
Description
The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a publicly accessible file if a specific parameter is used when requesting them. Combining those two issues, an attacker could gain access to a logged in admin cookies by making them open a malicious link or page
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Translate Wordpress With Gtranslate · Gtranslate
before 2.9.9 · source: NVD
Affected product
TW
Translate Wordpress With Gtranslate
Gtranslate
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-0770
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-0770
Exploit
https://wpscan.com/vulnerability/49abe79c-ab1c-4dbf-824c-8daaac7e079d
More from Translate Wordpress With Gtranslate
6.1
CVE-2020-11930
The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link
4.8
CVE-2023-4502
The Translate WordPress with GTranslate WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
4.7
CVE-2021-25103
The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the url_addon/gtranslate-email.php file before outputting…