EUVD-2026-95726
GHSA-2rxj-mcm9-wrqm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitSend request to unprotected plugin endpoint
-
ExecutionBypass missing authorization check
-
ImpactAlter translation content or settings
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account on the target WordPress site, consistent with PR:L - the Missing Authorization flaw lets an under-privileged but logged-in user reach functionality gated only by an absent or incorrectly configured access-control check in AI Translation for Polylang ≤1.6.2. Limiting factors: the attacker must first obtain valid credentials or a registerable low-privilege role (sites that disable open registration and restrict account creation materially reduce exposure), the target must run the vulnerable plugin version 1.6.2 or earlier alongside Polylang, and impact is bounded to partial integrity and availability (no confidentiality loss). The exact vulnerable feature/endpoint is not detailed in the available input and should be confirmed against the Patchstack advisory. |
| Impact | This is a moderate-severity, authenticated access-control flaw (CWE-862 Missing Authorization) rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4) indicates network-reachable, low-complexity exploitation requiring some level of existing privilege (PR:L), with no user interaction and only partial integrity and availability impact and no confidentiality impact. No EPSS score, SSVC decision data, KEV entry, or public POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent: the plugin's small deployment footprint, the requirement for an authenticated account, and the limited (I:L/A:L, C:N) impact all point to a real-but-secondary patch-cycle priority rather than a drop-everything issue. The main missing signals are exploitation-probability (EPSS) and a confirmed fixed version, both absent from the single Patchstack reference. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged authenticated account (e.g., a subscriber or contributor) on a WordPress site running AI Translation for Polylang ≤1.6.2 invokes a plugin action that lacks a proper capability/authorization check. Because the missing authorization check does not verify the caller's role, the attacker triggers translation-related functionality they should not be allowed to use, modifying content or settings (I:L) and potentially disrupting the feature (A:L). No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Missing authorization in the Cool Plugins 'AI Translation for Polylang' WordPress plugin (through version 1.6.2) allows an authenticated, low-privilege user to reach plugin functionality that is gated only by an absent or incorrectly configured access-control check (CWE-862). Exploitation requires a valid account on the target site - consistent with the CVSS PR:L metric - so sites that allow open registration or that grant contributor/subscriber roles broadly are the most exposed; impact is bounded to partial integrity and availability (C:N/I:L/A:L), with no confidentiality loss and no server-side code execution implied by the assessed vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the intelligence feed, so this is best treated as a moderate-severity hardening issue rather than an emergency.
RemediationAI
Patch status is not confirmed by the supplied intelligence: no fixed version number is provided, so administrators should check the Patchstack record and the Cool Plugins release notes at https://patchstack.com/database/wordpress/plugin/automatic-translations-for-polylang/vulnerability/wordpress-ai-translation-for-polylang-plugin-1-6-2-broken-access-control-vulnerability?_s_id=cve and upgrade AI Translation for Polylang the moment a release later than 1.6.2 is published; until then, treat 1.6.2 and earlier as vulnerable. Because exploitation requires an authenticated account (PR:L), the highest-value compensating control is to eliminate the low-privilege foothold: disable open user registration and remove or re-scope untrusted subscriber/contributor accounts on sites running the plugin - the trade-off is that legitimate self-service account creation and editorial workflows must be handled manually or via an invitation-only process. If AI translation is not actively used, deactivating and deleting the plugin removes the attack surface entirely, at the cost of losing automated translation functionality. A virtual patching or WAF rule that blocks requests to the plugin's translation-related AJAX/REST endpoints from users lacking administrator capabilities can reduce exposure, but such rules must be tuned against the confirmed vulnerable route (not specified in this input) to avoid breaking legitimate editor or admin use of the plugin. Finally, monitor the site's AI translation API usage and translation table for unexpected changes, since the assessed I:L/A:L impact is most likely to manifest as tampered translation strings or exhausted translation quota rather than a visible site outage.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable component is a WordPress plugin, AI Translation for Polylang, distributed under the slug automatic-translations-for-polylang and published by Cool Plugins; the CPE cpe:2.3:a:cool_plugins:ai_translation_for_polylang:*:*:*:*:*:*:*:* confirms the affected product identity and that all versions up to and including 1.6.2 are in scope. The plugin extends Polylang, an open-source multilingual framework for WordPress, and therefore only applies to sites where Polylang is also installed and translations are being managed. CWE-862 (Missing Authorization) means the root cause is not a memory-safety or injection flaw but a failure to enforce capability checks - typically a missing current_user_can()/permission_callback()/nonce check on an AJAX handler, REST route, or admin-post action, allowing any logged-in user to invoke privileged plugin logic. With a vector of AV:N/AC:L/PR:L/UI:N and impact of C:N/I:L/A:L, the realistic consequences are unauthorized modification of translation-related data and consumption or disruption of translation resources rather than data theft or full site compromise; the specific vulnerable endpoint or feature is not enumerated in the available input and should be confirmed in the Patchstack advisory. The Patchstack classification 'Exploiting Incorrectly Configured Access Control Security Levels' and the tag 'Authentication Bypass' describe the same access-control class of weakness, though under the assessed vector the attacker must already hold a valid low-privilege session rather than being fully unauthenticated.
Know when Ai Translation For Polylang gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Missing authorization reachable over the network by any logged-in low-privilege user (PR:L, AC:L, UI:N); partial integrity/availability impact and no data disclosure (C:N, I:L, A:L).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Translation for Polylang: from n/a through 1.6.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB