EUVD-2026-55948
GHSA-4x7q-j5rr-vh2q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible AJAX endpoint requires authenticated session (PR:L); only language config integrity is impacted (I:L), with no confidentiality or availability loss and no scope change.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.
AnalysisAI
Ray Enterprise Translation WordPress plugin (≤1.7.3) exposes an AJAX action without any capability or nonce validation, allowing any authenticated WordPress user - including the lowest-privilege Subscriber role - to add or delete the site's configured languages. The CVSS vector (PR:L, S:U, I:L, C:N, A:N) reflects limited integrity impact confined to language configuration, with no code execution or data exposure risk. No public exploit is identified and EPSS sits at 0.13% (3rd percentile), confirming this is low-priority exploitation pressure at this time.
Technical ContextAI
WordPress plugin AJAX endpoints are expected to enforce two distinct access controls: a capability check via current_user_can() to gate actions by user role, and a nonce token to prevent cross-site request forgery. This plugin's affected AJAX action omits both controls (CWE-862: Missing Authorization), meaning any HTTP POST to that endpoint with a valid WordPress authentication cookie is accepted without further validation - regardless of whether the caller is an Administrator or a Subscriber. The affected functionality manages the site's multilingual language configuration, which in translation-enabled WordPress deployments can affect content routing, locale assignment, and SEO-sensitive hreflang tags. Affected version range is ≤1.7.3 per WPScan and EUVD-2026-55948; no CPE string was provided in source data.
RemediationAI
No vendor-released patched version has been confirmed from available data - all versions through 1.7.3 are affected. Administrators should monitor the WPScan advisory (https://wpscan.com/vulnerability/3dd9bf3b-7fe4-4a58-ad05-1fc0bfb85413/) and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-14549) for a patched release. As an immediate compensating control, disable open user registration (Settings > General > uncheck 'Anyone can register') to prevent untrusted subscribers from obtaining the authentication required to exploit the endpoint; this has no impact on existing content or language configuration. If the translation functionality is non-essential, deactivating the plugin entirely eliminates exposure at the cost of removing multilingual capabilities. Sites where all authenticated users are trusted (private intranets or invitation-only communities) face negligible operational risk and may defer patching until an official release is available.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today