CVE-2026-14548

Deferred Deferred - Pending Action

Ray Enterprise Translation WordPress Plugin Authentication Bypass

Publication date: 2026-08-11

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-26

Generated

2026-08-31

AI Q&A

2026-08-11

EPSS Evaluated

2026-08-30

NVD

CVE-2026-14548

EUVD

EUVD-2026-55947

Affected Vendors & Products

Vendor	Product	Version / Range
ray_enterprise_translation	plugin	to 1.7.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Ray Enterprise Translation WordPress plugin up to version 1.7.3. It allows any authenticated user, including those with Subscriber-level access, to overwrite the administrator-configured translation API token with an arbitrary value due to missing capability or nonce checks on an AJAX action.

Detection Guidance

Check if the Ray Enterprise Translation plugin version 1.7.3 or lower is installed on your WordPress site. Inspect network traffic for unauthorized AJAX requests to the vulnerable endpoint, particularly those attempting to update API tokens without proper authentication.

Impact Analysis

An attacker could exploit this to change the API token used for translations, potentially disrupting translation services or redirecting them to malicious endpoints. This could lead to data leaks or unauthorized content modifications on the website.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized changes to API tokens, potentially exposing sensitive data or violating data integrity requirements under GDPR or HIPAA if translation services handle protected information.

Mitigation Strategies

Immediately update the Ray Enterprise Translation plugin to the latest version if an update is available. If no update exists, consider disabling the plugin until a patch is released. Restrict user roles to prevent Subscribers from making unauthorized changes.

Hi! I’m here to help you understand CVE-2026-14548. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70