CVE-2022-25812: 
WordPress vulnerability analysis and mitigation

The Transposh WordPress Translation plugin before version 1.0.8 contains a Remote Code Execution (RCE) vulnerability identified as CVE-2022-25812. The vulnerability was discovered by security researcher Julien Ahrens and publicly disclosed on February 22, 2022. The issue stems from the plugin's failure to properly validate its debug settings, which could allow high-privilege users such as administrators to execute arbitrary code (WPScan).

The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and falls under the OWASP Top 10 category A1: Injection (NVD, WPScan).

If exploited, this vulnerability allows authenticated administrators to perform remote code execution on the affected WordPress installation, potentially leading to complete system compromise with high impacts on confidentiality, integrity, and availability of the system (NVD).

The vulnerability has been fixed in version 1.0.8 of the Transposh WordPress Translation plugin. Users are strongly advised to update to this version or later to mitigate the risk (WPScan).