CVE-2022-2461
Published: April 11, 2026
Official Description
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.
Risk Analysis
This vulnerability in the Transposh WordPress Translation plugin allows unauthenticated users to change settings due to insufficient permission checks. The absence of CVSS and EPSS scores means we cannot assess its technical severity or typical exploitation likelihood, but its presence in CISA's KEV indicates confirmed exploitation.
This vulnerability is actively exploited in the wild. The flaw is remotely exploitable by unauthenticated attackers.
Upgrade the Transposh WordPress Translation plugin to a version beyond 1.0.9.6. Ensure all WordPress plugins are kept up-to-date and have proper permission checks configured.
Technical Analysis
CVE-2022-2461 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2022-2461 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2022-2461 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1