Vulnerability · Published Nov 21, 2022 · Assigned by WPScan
CVE-2022-3691DeepL Pro API Translation < 1.7.5 - API Key Disclosure
High 7.5
In plain English
A high-severity security flaw in DeepL Pro API translation plugin from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.0%top 38.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an external, unauthenticated visitor.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | DeepL Pro API translation plugin | 0 – before 1.7.5 |
References
- https://wpscan.com/vulnerability/4248a0af-1b7e-4e29-8129-3f40c1d0c560 exploit, vdb-entry, technical-description