CVE-2022-2536 in Transposh Translation Plugin
Summary
by MITRE • 12/15/2022
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient validation of settings on the 'tp_translation' AJAX action which makes it possible for unauthenticated attackers to bypass any restrictions and influence the data shown on the site. Please note this is a separate issue from CVE-2022-2461.
Notes from the researcher: When installed Transposh comes with a set of pre-configured options, one of these is the "Who can translate" setting under the "Settings" tab. However, this option is largely ignored, if Transposh has enabled its "autotranslate" feature (it's enabled by default) and the HTTP POST parameter "sr0" is larger than 0. This is caused by a faulty validation in "wp/transposh_db.php."
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/09/2026
The Transposh WordPress Translation plugin vulnerability CVE-2022-2536 represents a critical authorization bypass flaw that allows unauthenticated attackers to manipulate core plugin settings. This vulnerability exists within the plugin's handling of AJAX requests, specifically targeting the 'tp_translation' endpoint that lacks proper input validation mechanisms. The flaw affects all versions up to and including 1.0.9.6, making it a widespread concern for WordPress installations that utilize this translation plugin. The vulnerability stems from inadequate security controls in the wp/transposh_db.php file where the plugin fails to properly validate HTTP POST parameters, particularly the "sr0" parameter that controls translation behavior.
The technical exploitation of this vulnerability occurs through the manipulation of the "Who can translate" setting, which is designed to restrict translation capabilities to authenticated users or specific roles. However, when the autotranslate feature is enabled by default, attackers can bypass these restrictions by sending a POST request with the "sr0" parameter set to a value greater than zero. This parameter essentially overrides the intended access controls, allowing unauthorized users to modify critical plugin settings and influence the translation behavior of the entire website. The flaw demonstrates poor input sanitization practices and highlights the importance of proper authorization checks even in seemingly benign administrative functions. This vulnerability falls under CWE-285, which addresses insufficient authorization issues, and aligns with ATT&CK technique T1078.004 for valid accounts and T1566.002 for spearphishing attachments, as attackers could potentially leverage this to gain unauthorized control over website content.
The operational impact of this vulnerability extends beyond simple setting modifications, as it allows attackers to fundamentally alter how translation services function on the affected website. An attacker could potentially enable or disable translation features, change language preferences, or manipulate the plugin's behavior to redirect traffic or display malicious content. The default-enabled autotranslate feature compounds the risk, as it means that even administrators who might have expected protection through proper access controls are vulnerable. This creates a scenario where attackers can silently modify website functionality without requiring authentication credentials, potentially leading to content injection, language manipulation, or service disruption. The vulnerability essentially provides a backdoor for unauthorized modification of translation settings, which could be exploited to compromise the integrity of multilingual websites and potentially serve as a stepping stone for more sophisticated attacks. Organizations using this plugin should immediately implement mitigations including disabling the plugin until a patched version is available, implementing proper access controls, and monitoring for unauthorized changes to plugin settings. The vulnerability also underscores the necessity of proper security testing for WordPress plugins, particularly those handling user-facing content or translation services, as the flaw demonstrates how a single input validation error can lead to significant unauthorized access capabilities.