CVE-2022-3691

DeepL Pro API Translation < 1.7.5 - API Key Disclosure

CVSS 7.5 HIGHEPSS 0.9%

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

21 Nov 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an external, unauthenticated visitor.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Unknown · DeepL Pro API translation plugin

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://wpscan.com/vulnerability/4248a0af-1b7e-4e29-8129-3f40c1d0c560