Vulnerability · Published Sep 19, 2022 · Assigned by WPScan
CVE-2022-3141Translatepress Multilinugal < 2.3.3 - Admin+ SQLi
High 8.8
In plain English
A high-severity SQL injection in Translate Multilingual sites – TranslatePress from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.2% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS NVD)8.8High
Exploit odds (30 days)5.2%top 7.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Translate Multilingual sites – TranslatePress | 2.3.3 – before 2.3.3 |
Weakness: CWE-89
References
- https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-translatepress-multilingual-wordpress-plugin-effc08eda514
- https://wpscan.com/vulnerability/1fa355d1-cca8-4b27-9d21-0b420a2e1bf3
- http://packetstormsecurity.com/files/171479/WordPress-Translatepress-Multilingual-SQL-Injection.html