« Volver al listado

CVE-2022-3141

Estado: ModificadaAlta (8.8)—

The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cozmoslabs — Translatepress

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-3141",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Translate Multilingual sites – TranslatePress",
          "versions": [
            {
              "status": "affected",
              "version": "2.3.3",
              "lessThan": "2.3.3",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-09-19T14:15:11.307",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/171479/WordPress-Translatepress-Multilingual-SQL-Injection.html",
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-translatepress-multilingual-wordpress-plugin-effc08eda514",
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/1fa355d1-cca8-4b27-9d21-0b420a2e1bf3",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/171479/WordPress-Translatepress-Multilingual-SQL-Injection.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-translatepress-multilingual-wordpress-plugin-effc08eda514",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wpscan.com/vulnerability/1fa355d1-cca8-4b27-9d21-0b420a2e1bf3",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected."
    },
    {
      "lang": "es",
      "value": "El plugin Translate Multilingual sites de WordPress versiones anteriores a 2.3.3, es vulnerable a una inyección SQL autenticada. Al añadir un nuevo idioma (por medio de la página de configuración) que contenga determinados caracteres especiales, pueden sobrepasarse las marcas de la consulta SQL y puede inyectarse una carga útil ciega basada en el tiempo"
    }
  ],
  "lastModified": "2026-06-17T04:58:56.603",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cozmoslabs:translatepress:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF863D87-25A4-43E0-A137-7FAD1F5FD301",
              "versionEndExcluding": "2.3.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}