Transposh WordPress Translation 1.0.8.1 Remote Code Execution

RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
   =======================
   Product: Transposh WordPress Translation
   Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/
   Type: Reliance on File Name or Extension of Externally-Supplied File [CWE-646]
   Date found: 2022-02-21
   Date published: 2022-07-22
   CVSSv3 Score: 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
   CVE: CVE-2022-25812

2. CREDITS
   ==========
   This vulnerability was discovered and researched by Julien Ahrens from
   RCE Security.

3. VERSIONS AFFECTED
   ====================
   Transposh WordPress Translation 1.0.8.1 and below

4. INTRODUCTION
   ===============
   Transposh translation filter for WordPress offers a unique approach to blog
   translation. It allows your blog to combine automatic translation with human
   translation aided by your users with an easy to use in-context interface.

(from the vendor’s homepage)

5. VULNERABILITY DETAILS
   ========================
   The plugin’s “save_transposh” action available at “/wp-admin/admin.php?page=tp_advanced”
   does not properly validate the “Log file name” allowing an attacker with the
   “Administrator” role to specify a .php file as the log destination.

Since the log file is stored directly within the “/wp-admin” directory, executing
arbitrary PHP code is possible by simply sending a crafted request that gets
logged.

Successful exploits can allow the attacker to compromise the entire WordPress
installation. This is specifically relevant in multi-site installations.

6. PROOF OF CONCEPT
   ===================
   1.Go to “/wp-admin/admin.php?page=tp_advanced” and “Enable debugging” by pointing
   it to a filename with a .php extension.
   2.Set the “Level of logging” to “Debug”
   3.Saving the settings
   4.Submit a payload like “<?php phpinfo();?>” to any of Transposh’s functionalities.
   5.Go to "/wp-admin/[your-filename.php]" to trigger the code injection

7. SOLUTION
   ===========
   None. Remove the plugin to prevent exploitation.

8. REPORT TIMELINE
   ==================
   2022-02-21: Discovery of the vulnerability
   2022-02-21: Contacted the vendor via email
   2022-02-21: Vendor response
   2022-02-22: CVE requested from WPScan (CNA)
   2022-02-23: WPScan assigns CVE-2022-25812
   2022-05-22: Sent request for status update on the fix
   2022-05-24: Vendor states that there is no update planned so far
   2022-07-22: Public disclosure

9. REFERENCES
   =============
   https://github.com/MrTuxracer/advisories