Infility Global CVE-2026-109931

Per the description there are no special prerequisites: the AJAX action is available to unauthenticated users and performs no authorization or nonce check, so any visitor can invoke it against an affected Infility Global installation before 2.16.25. Exploitation is limited in effect rather than in access - the only stated outcome is overwriting a single machine-translation configuration value belonging to the companion plugin (integrity-only, Low), with no confidentiality or availability impact. The supplied vector's AC:H implies some additional condition on triggering, but no such condition (timing, race, or non-default setting) is described in the available sources.

This is a low-severity, limited-impact issue despite being remotely and unauthenticatedly reachable. The CVSS 3.1 vector (AV:N/PR:N/UI:N) confirms a network-reachable, pre-authentication AJAX action, which normally raises concern, but every impact metric except integrity is None and integrity is only Low (C:N/I:L/A:N) - the attacker can only overwrite one machine-translation configuration value, not achieve data disclosure, code execution, or denial of service. The input vector carries AC:H, yet the description gives no mechanism (no race, timing, or attacker-uncontrolled precondition is stated), so the basis for High complexity is unexplained in the available sources; a missing-nonce/missing-authorization AJAX endpoint reachable by 'any visitor' reads as low complexity, and this discrepancy should be verified with WPScan/the vendor. No EPSS score and no SSVC exploitation sub-scores were provided; the vuln.today decision label is 'monitor', KEV is not listed, and only a PoC reference (not verified working exploit code) exists. Taken together the signals are consistent: this is a genuine broken-access-control bug worth patching on a normal cycle, not an emergency - a high-reachability but low-real-impact configuration-tampering flaw rather than a priority exploitation target.

An unauthenticated visitor sends a crafted request to the exposed AJAX action, which performs no authorization or nonce validation, and overwrites the companion Infility Global plugin's machine-translation configuration value. A public PoC reference (WPScan) exists but is not verified as working exploit code, so the practical trigger and any complexity factor implied by the input's AC:H are not described in the available sources.