CVE-2022-4169CWE-862

Theme and plugin translation for Polylang <= 3.2.16 - Missing Authorization

Medium · published November 28, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
53.2
In the wild
Unconfirmed
What it is

The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks in the process_polylang_theme_translation_wp_loaded() function. This makes it possible for unauthenticated attackers to update plugin and theme translation settings and to import translation strings.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00716 · 53.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2022-11-28T17:33Z
EPSS history
Timeline
  • 28 NOV 17:33Z
    Theme and plugin translation for Polylang <= 3.2.16 - Missing Authorization
    cvelistv5