Vulnerabilities > CVE-2022-4169 - Missing Authorization vulnerability in Theme and Plugin Translation for Polylang Project Theme and Plugin Translation for Polylang

047910
CVSS 5.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
LOW
Availability impact
NONE

Summary

The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks in the process_polylang_theme_translation_wp_loaded() function. This makes it possible for unauthenticated attackers to update plugin and theme translation settings and to import translation strings.

Vulnerable Configurations

Part Description Count
Application
Theme_And_Plugin_Translation_For_Polylang_Project
33

Common Weakness Enumeration (CWE)