What is the CVSS score of CVE-2026-4683?

CVE-2026-4683 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.1%.

Smartcat Translator for WPML CVE-2026-4683

EUVD-2026-30515 MEDIUM

Missing Authorization (CWE-862)

2026-05-15 Wordfence

GHSA-3rhq-g36f-cvc7

Authentication Bypass Denial Of Service WordPress

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 15, 2026 - 09:31 vuln.today

CVE Published

May 15, 2026 - 07:46 nvd

MEDIUM 6.5

DescriptionCVE.org

The Smartcat Translator for WPML plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'routeData' REST endpoint in all versions up to, and including, 3.1.77. This makes it possible for unauthenticated attackers to overwrite the plugin's Smartcat API credentials (account ID, API secret key, hub key, API host, and hub host), effectively hijacking the translation service or causing a denial of service.

AnalysisAI

Unauthenticated attackers can modify Smartcat API credentials in the Smartcat Translator for WPML plugin through a missing capability check on the 'routeData' REST endpoint, allowing hijacking of translation services or denial of service. All versions through 3.1.77 are affected. The vulnerability requires only network access and no user interaction, making it remotely exploitable by any unauthenticated actor against default WordPress configurations running the vulnerable plugin.

Technical ContextAI

The Smartcat Translator for WPML is a WordPress plugin that integrates Smartcat's translation API with WPML (WordPress Multilingual Plugin). The vulnerability exists in the REST API endpoint 'routeData' implemented in the Router and CallbackController classes. The root cause is a missing WordPress capability check (CWE-862: Missing Authorization), which allows the REST endpoint to process requests without validating that the requester has appropriate administrative privileges. REST endpoints in WordPress should validate user capabilities before allowing data modification; this plugin fails to do so, exposing sensitive API credentials (account ID, API secret key, hub key, API host, hub host) stored in plugin settings to unauthorized modification.

RemediationAI

Update the Smartcat Translator for WPML plugin to version 3.1.78 or later, which includes a fix adding the required capability checks to the 'routeData' REST endpoint (confirmed by the changelog at https://plugins.trac.wordpress.org/changeset/3524382/). If immediate patching is not feasible, disable the Smartcat plugin entirely until an update can be applied-this eliminates the vulnerable endpoint. Alternatively, restrict REST API access at the web server level using .htaccess (Apache) or nginx configuration to block requests to /wp-json/smartcat/ paths from untrusted networks, though this may break legitimate translation workflows if Smartcat makes requests from external IPs. After patching, audit the Smartcat API credentials in WordPress settings (Admin → Smartcat settings) and regenerate the API secret key and account tokens in the Smartcat platform to invalidate any credentials that may have been exposed or overwritten during the vulnerability window.