CVE-2022-4169
Medium
Description
The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks in the process_polylang_theme_translation_wp_loaded() function. This makes it possible for unauthenticated attackers to update plugin and theme translation settings and to import translation strings.
SeverityMedium
CVSS6.5
Exploit probability—
ProductTheme And Plugin Translation For Polylang
PublishedNov 28, 2022
First seenNov 28, 2022
Weakness typeCWE-862Missing authorization
How to fix
Update
- theme_and_plugin_translation_for_polylang_project theme_and_plugin_translation_for_polylang3.2.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| theme_and_plugin_translation_for_polylang_project theme_and_plugin_translation_for_polylang | v < 3.2.17 | 3.2.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.