WordPress Plugin Vulnerabilities

Force Update Translations < 0.6.0 - Cross-Site Request Forgery

Description

The Force Update Translations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
force-update-translations
Fixed in 0.6.0

References

CVE
CVE-2025-58236
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e1fcc06a-9571-44c3-b3ff-286ccda1abea

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nabil Irawan
Verified
No
WPVDB ID
56126ff9-8f88-4b0f-b69a-ff14575d30da

Timeline

Publicly Published
2025-09-22 (about 1 year ago)
Added
2025-09-26 (about 11 months ago)
Last Updated
2026-01-06 (about 8 months ago)

Other

Published
Title
Published
2025-10-16
Title
CloudSearch <= 3.0.0 - Cross-Site Request Forgery
Published
2025-12-04
Title
Media Library Downloader < 1.4.1 - Cross-Site Request Forgery
Published
2022-02-22
Title
WP Google Map < 4.2.4 - Marker Category/Map Deletion via CSRF
Published
2024-10-21
Title
Category and Taxonomy Meta Fields <= 1.0.0 - Cross-Site Request Forgery to Taxonomy Meta Add/Delete
Published
2025-12-04
Title
Torod – The smart shipping and delivery portal for e-shops and retailers < 2.0 - Cross-Site Request Forgery To Plugin's Settings Modification