CVE-2022-25812

Related Files

Transposh WordPress Translation 1.0.8.1 Remote Code Execution

Posted Jul 29, 2022

Authored by Julien Ahrens | Site rcesecurity.com

Transposh WordPress Translation versions 1.0.8.1 and below have a "save_transposh" action available at "/wp-admin/admin.php?page=tp_advanced" that does not properly validate the "Log file name" allowing an attacker with the "Administrator" role to specify a .php file as the log destination. Since the log file is stored directly within the "/wp-admin" directory, executing arbitrary PHP code is possible by simply sending a crafted request that gets logged.

tags | exploit, arbitrary, php

advisories | CVE-2022-25812

SHA-256 | 8347827a18239dee9d623ea317bc7751b1e867031f7d4bbe6349594f42f4006f

Download | Favorite | View