Stored XSS in GPTranslate WordPress Plugin via REST API

Executive Summary

The GPTranslate – Multilingual AI Translation for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) through its REST API Translation Storage. This vulnerability exists in all versions up to and including 2.31 due to insufficient input sanitization and output escaping.

An unauthenticated attacker can inject malicious web scripts into pages, which will execute whenever a user accesses those pages. Additionally, the plugin exposes a deterministically derived API key (a sha256 hash of the site URL) in the HTML source code, allowing any visitor to retrieve it and submit malicious translation payloads to the plugin's REST API endpoint without any further authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary scripts in the context of your website for any user who visits an injected page. This can lead to theft of user credentials, session hijacking, defacement, or distribution of malware.

Since the API key is exposed and can be used without authentication, attackers can repeatedly submit malicious translation data, potentially compromising the integrity and security of your website content and user interactions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of the deterministically derived API key (sha256 of the site URL) in the HTML source of your WordPress pages, specifically in the JavaScript variable gptApiKey.

Additionally, monitoring or scanning for requests to the endpoint /wp-json/gptranslate/v1/request that include suspicious or unexpected translation payloads can help identify exploitation attempts.

A simple command to check for the API key in the HTML source of a page could be using curl and grep, for example:

• curl -s https://your-wordpress-site.com | grep gptApiKey

To detect suspicious POST requests to the vulnerable REST API endpoint, you can use network monitoring tools or web server logs to filter requests to /wp-json/gptranslate/v1/request.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the GPTranslate – Multilingual AI Translation for WordPress plugin to a version later than 2.31 where the vulnerability is fixed.

If an update is not immediately possible, consider disabling or restricting access to the /wp-json/gptranslate/v1/request REST API endpoint to prevent unauthenticated attackers from submitting malicious translation payloads.

Additionally, review and sanitize any user-generated content or translations that may have been injected via this vulnerability.

Useful 0 Not Useful 0