Introduction
An attacker with nothing more than a Subscriber-level account can make themselves a full administrator on any WordPress site running My WP Translate up to and including version 1.1. That is privilege escalation leading straight to site takeover.
MyThemeShop develops My WP Translate to manage translations for themes and plugins. It is less widely deployed than some major translation plugins, but it runs on thousands of sites and has a history of security issues.
Technical information
The vulnerability is in the ajax_import_strings() function, present in every version of My WP Translate up to and including 1.1. The plugin registers this function as a WordPress AJAX action that any authenticated user can call, and the function processes requests without a capability check such as current_user_can('manage_options').
So any logged-in user, down to the lowest Subscriber role, can send a crafted AJAX request to wp-admin/admin-ajax.php with the right action parameter. The function takes the user-supplied data and updates arbitrary WordPress options in the wp_options table.
The most damaging exploit sets two options:
users_can_registerto1(enables public registration)default_roletoadministrator(makes all new users administrators)
With both in place, the attacker registers a new account and immediately has administrator privileges. The site is fully compromised.
The root cause is a missing authorization check (CWE-862) on a sensitive AJAX endpoint, a recurring anti-pattern in WordPress plugin development. The vulnerable function is in the plugin's public source:
Affected systems and versions
- Product: My WP Translate WordPress plugin
- Affected versions: All versions up to and including 1.1
- Any WordPress site with this plugin active is vulnerable
- Exploitation requires any authenticated user account (Subscriber or higher)
Vendor security history
MyThemeShop, the vendor behind My WP Translate, has a history of security issues in this plugin. Earlier versions, such as 1.0.3, had unprotected AJAX actions, cross-site scripting, and option-deletion vulnerabilities. The vendor's response to past vulnerabilities has varied, and there is no evidence of proactive security advisories or rapid patch cycles.
