CVE-2026-14549
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.
Risk Assessment
The risk includes unauthorized modification of language configuration, which could disrupt site functionality or cause data loss.
Recommendation
Update the plugin to the latest version and restrict access to the admin panel for low-privilege users.
Original NVD description (English source)
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.