CVE-2022-3691

DeepL Pro API Translation < 1.7.5 - API Key Disclosure

The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files that are publicly accessible to an external, unauthenticated visitor.

Affected

DeepL Pro API translation plugin

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.93% chance of exploitation in the next 30 days, 60th percentile

Published

2022-11-21

Updated

2025-04-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/4248a0af-1b7e-4e29-8129-3f40c1d0c560

References

• CVE Record
• NVD entry