Ai Translation For Polylang
Monthly
Missing authorization in the Cool Plugins 'AI Translation for Polylang' WordPress plugin (through version 1.6.2) allows an authenticated, low-privilege user to reach plugin functionality that is gated only by an absent or incorrectly configured access-control check (CWE-862). Exploitation requires a valid account on the target site - consistent with the CVSS PR:L metric - so sites that allow open registration or that grant contributor/subscriber roles broadly are the most exposed; impact is bounded to partial integrity and availability (C:N/I:L/A:L), with no confidentiality loss and no server-side code execution implied by the assessed vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the intelligence feed, so this is best treated as a moderate-severity hardening issue rather than an emergency.
Missing authorization in the Cool Plugins 'AI Translation for Polylang' WordPress plugin (through version 1.6.2) allows an authenticated, low-privilege user to reach plugin functionality that is gated only by an absent or incorrectly configured access-control check (CWE-862). Exploitation requires a valid account on the target site - consistent with the CVSS PR:L metric - so sites that allow open registration or that grant contributor/subscriber roles broadly are the most exposed; impact is bounded to partial integrity and availability (C:N/I:L/A:L), with no confidentiality loss and no server-side code execution implied by the assessed vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the intelligence feed, so this is best treated as a moderate-severity hardening issue rather than an emergency.