Translate Drupal with GTranslate EUVD-2026-30989

Exploitation requires an authenticated session with high-level Drupal privileges (PR:H per CVSS vector), meaning the attacker must already hold administrator or equivalent role access on the target Drupal site. The attack is network-accessible (AV:N) with low complexity (AC:L) and requires no user interaction beyond the attacker's own actions. No special non-default configuration is implied as a prerequisite beyond the module being installed and active. Limiting factors are significant: the high-privilege requirement (PR:H) restricts exploitation to trusted insiders, compromised administrator accounts, or privilege escalation scenarios; there is no confidentiality or availability impact (C:N, A:N), reducing attacker motivation; and the unchanged scope (S:U) means lateral movement to other system components is not enabled by this flaw alone.

Real-world risk is low. The CVSS base score of 2.7 (Low) is corroborated by multiple signals: PR:H (high privileges required) significantly limits the attacker pool to site administrators or equivalents; impact is confined to integrity (I:L) with no confidentiality or availability loss; scope is unchanged (S:U). EPSS at 0.02% in the 5th percentile confirms negligible exploitation interest from threat actors. There is no CISA KEV listing and no public exploit code identified at time of analysis. The primary realistic threat is an insider or compromised administrator account, not an external opportunistic attacker. One notable data inconsistency: the intelligence tags label this 'Information Disclosure' while the CVE description specifies 'Resource Location Spoofing' - these are distinct impact categories and the discrepancy should be verified against the vendor advisory before finalizing internal risk ratings. Overall this issue is low priority except for sites with untrusted administrator accounts or multi-tenant Drupal deployments.

An authenticated Drupal administrator navigates to the GTranslate module configuration page and modifies an assumed-immutable resource location value - such as the translation service endpoint URL - to point to an attacker-controlled server. Subsequent translation requests from site visitors are then directed to the spoofed location, enabling potential interception or manipulation of translation data. No public exploit code exists at time of analysis, and the high privilege bar makes opportunistic exploitation unlikely.