Themes Vulnerabilities

Theme and plugin translation for Polylang < 3.2.17 - Unauthenticated Translation Settings Update

Description

The theme does not have authorisation in the process_polylang_theme_translation_wp_loaded() function, which could allow unauthenticated attack to update translation settings, as well as import arbitrary translations

Affects Themes

theme-translation-for-polylang
Fixed in 3.2.17

References

CVE
CVE-2022-4169

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Florent BESNARD
Verified
No
WPVDB ID
bbcece1e-45c1-4b40-8b14-aedee6aa23cd

Timeline

Publicly Published
2022-11-28 (about 3 years ago)
Added
2022-11-28 (about 3 years ago)
Last Updated
2022-11-28 (about 3 years ago)

Other

Published
Title
Published
2025-10-15
Title
Felan Framework < 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation/Deactivation via process_plugin_actions
Published
2026-01-21
Title
BackItUp <= 2.1.0 - Missing Authorization
Published
2024-08-12
Title
Backup and Restore WordPress <= 1.50 - Missing Authorization
Published
2026-01-05
Title
GetGenie < 4.3.1 - Missing Authorization
Published
2024-10-23
Title
HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce < 2.11.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication