CVE-2026-109931
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Infility Global WordPress plugin before version 2.16.25 does not perform any authorization or nonce check on an AJAX action available to unauthenticated users. This allows any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before version 2.16.25.
Risk Assessment
An unauthenticated attacker could alter the machine-translation configuration, potentially causing site malfunction or misleading users.
Recommendation
Update the Infility Global plugin to version 2.16.25 or later, which includes the security fix.
Other vulnerabilities in Infility Global WordPress plugin
See all- CVE-2026-8163High
The Infility Global WordPress plugin before version 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability. This can be exploited by authenticated users with Subscriber-level access and above.
- CVE-2026-7842Medium
The Infility Global plugin for WordPress before version 2.15.20 does not sanitize or validate the orderby and order parameters in the import_list(), url_detail(), and file_detail() admin page callbacks. This allows authenticated attackers with Editor-level access or higher to perform time-based blind SQL injection and extract sensitive data from the database.
Original NVD description (English source)
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS