PT-2022-26027 · WordPress · Polylang

Florent Besnard · Published 2022-11-28 · Updated 2022-12-01 · CVE-2022-4169

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Polylang versions up to, and including, 3.2.16

Description The Theme and plugin translation for Polylang is vulnerable to authorization bypass due to missing capability checks in the process polylang theme translation wp loaded() function. This makes it possible for unauthenticated attackers to update plugin and theme translation settings and to import translation strings.

Recommendations For Polylang versions up to, and including, 3.2.16, update to a version higher than 3.2.16 to resolve the issue. As a temporary workaround, consider disabling the process polylang theme translation wp loaded() function until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2022-4169

Affected Products

Polylang

References · 7

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2814605%40theme-translation-for-polylang%2Ftrunk&old=2812254%40theme-translation-for-polylang%2Ftrunk&sfp_email=&sfph_mail= · Patch
• https://osv.dev/vulnerability/CVE-2022-4169 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4169 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9f6a358a-333c-4eb7-9149-348bf3713943?source=cve · Note
• https://t.me/cibsecurity/53594 · Telegram Post
• https://wordfence.com/vulnerability-advisories-continued/#CVE-2022-4169 · Note
• https://t.me/cvenotify/38600 · Telegram Post