CVE-2022-0770
📋 TL;DR
This vulnerability in the Translate WordPress with GTranslate plugin allows attackers to steal admin session cookies via CSRF attacks. Attackers can trick logged-in administrators into clicking malicious links, which writes sensitive debug data including cookies to publicly accessible files. WordPress sites using vulnerable plugin versions are affected.
💻 Affected Systems
- Translate WordPress with GTranslate WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full site compromise through admin account takeover, leading to data theft, malware injection, or complete site defacement.
Likely Case
Session hijacking of admin accounts, potentially leading to unauthorized content changes or plugin/theme modifications.
If Mitigated
Limited impact if CSRF protections are implemented elsewhere or if admin accounts have additional authentication factors.
🎯 Exploit Status
Exploitation requires social engineering to trick admin into clicking malicious link, but technical complexity is minimal.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.9 and later
Vendor Advisory: https://wpscan.com/vulnerability/49abe79c-ab1c-4dbf-824c-8daaac7e079d
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Translate WordPress with GTranslate'. 4. Click 'Update Now' if available, or manually update to version 2.9.9+. 5. Verify update completed successfully.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the Translate WordPress with GTranslate plugin until patched
Restrict file access
linuxBlock public access to debug files via .htaccess or web server configuration
# Add to .htaccess:
<Files "debug-*.log">
Order Allow,Deny
Deny from all
</Files>
🧯 If You Can't Patch
- Implement CSRF tokens on all admin actions using WordPress nonces
- Enable two-factor authentication for all admin accounts
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin → Plugins → Installed Plugins. If version is below 2.9.9, you are vulnerable.Check Version:
wp plugin list --name='Translate WordPress with GTranslate' --field=versionVerify Fix Applied:
Confirm plugin version is 2.9.9 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual admin login locations/times after cookie theft
- Unexpected file writes to debug logs in plugin directory
Network Indicators:
- HTTP requests to plugin files with suspicious parameters
- Outbound connections to unknown domains after admin login
SIEM Query:
source="wordpress.log" AND ("gtranslate" OR "translate-wordpress") AND ("debug" OR "cookie")