EUVD-2026-55947
GHSA-399x-gh4h-m243
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network AJAX endpoint (AV:N) requires only a subscriber account (PR:L); fully overwrites admin config (I:H) with no data exposure or service disruption.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value.
AnalysisAI
Translation API token hijacking in the Ray Enterprise Translation WordPress plugin (≤1.7.3) allows any authenticated user - including low-privilege Subscribers - to overwrite the administrator-configured translation API key via an unprotected AJAX endpoint that performs no capability or nonce checks. Publicly available exploit code exists per WPScan disclosure and SSVC assessment, though EPSS at 0.13% (3rd percentile) reflects limited observed exploitation to date. The primary impact is integrity: a successful attacker can silently substitute a rogue API token, redirecting translation requests through an attacker-controlled account and enabling billing fraud or service disruption without any administrator awareness.
Technical ContextAI
The vulnerability stems from CWE-862 (Missing Authorization) in a WordPress AJAX handler registered by the Ray Enterprise Translation plugin. WordPress plugins register AJAX endpoints via wp_ajax_ hooks accessible to any authenticated session at wp-admin/admin-ajax.php; without a capability check (e.g., current_user_can('manage_options')) and a nonce verification call, any logged-in user - regardless of role - can invoke the handler and write to protected plugin settings. The affected plugin, Ray Enterprise Translation through version 1.7.3 (EUVD-2026-55947), exposes an action that writes the translation API token directly to the WordPress options table, a value that is architecturally reserved for administrator control. No CPE string was included in the available intelligence data, but the affected software is unambiguously identified as the Ray Enterprise Translation plugin across all version 0 through 1.7.3.
RemediationAI
No vendor-released patch identified at time of analysis - no fixed version is referenced in WPScan, NVD, or EUVD-2026-55947. Administrators should immediately deactivate and remove the Ray Enterprise Translation plugin until a patched release is confirmed available via the WPScan advisory at https://wpscan.com/vulnerability/e1e0e945-db49-4e27-b143-ef3520a39db9/. As the most effective compensating control, disabling open WordPress user registration (Settings > General, uncheck 'Anyone can register') removes the primary attack path, since the exploit requires at minimum a Subscriber-level account - the trade-off is that legitimate self-registration workflows are interrupted. If subscriber accounts are operationally required, a WAF rule blocking POST requests to wp-admin/admin-ajax.php containing the specific vulnerable action parameter from non-administrator roles can neutralize this endpoint without disabling the plugin entirely, though identifying the exact action name requires inspecting plugin source code. Rotating the translation API token after any suspected exploitation is also recommended, as the attacker's substituted token may remain active.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today