CVE-2026-14548: 
WordPress Analyse et atténuation des vulnérabilités

CVE-2026-14548 is a Missing Authorization (CWE-862) vulnerability in the Ray Enterprise Translation WordPress plugin that allows any authenticated user, including those with Subscriber-level access, to overwrite the administrator-configured translation API token with an arbitrary value. It affects all versions of the plugin through 1.7.3, with no fixed version currently available. The vulnerability was publicly disclosed on August 8, 2026, and was discovered by researcher Akshat Parikh (SN1PER). It carries a CVSS score of 4.3 (Medium) (WPScan, GitHub Advisory).

The root cause is a complete absence of capability checks and nonce verification on one of the plugin's AJAX action handlers (CWE-862: Missing Authorization). WordPress plugins typically protect sensitive administrative actions by verifying that the requesting user has sufficient privileges (e.g., current_user_can()) and that the request includes a valid nonce token; this plugin omits both controls on the affected endpoint. Any authenticated WordPress user — even one with the minimal Subscriber role — can craft an AJAX request to the vulnerable action and supply an arbitrary string as the new API token value, overwriting the legitimate administrator-configured credential. The WPScan advisory notes that a Proof of Concept is scheduled for public release on August 22, 2026 (WPScan).

Successful exploitation allows any authenticated user to replace the site's translation API token with an attacker-controlled or invalid value, effectively disrupting or hijacking the translation service. If the attacker substitutes their own API token, they may be able to redirect translation requests to an account they control, potentially exposing content being translated or incurring charges on the legitimate API account. While this vulnerability does not directly enable remote code execution or full site takeover, it undermines the integrity of the translation service configuration and could be chained with other weaknesses for broader impact (WPScan, GitHub Advisory).

There is no evidence of active in-the-wild exploitation at this time, and no public proof-of-concept exploit has been released yet; WPScan has indicated the PoC will be published on August 22, 2026. The EPSS score is 0.0, reflecting low current exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only a valid WordPress account at any privilege level, making the attack surface broad on sites with open user registration (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Ray Enterprise Translation (lingotek-translation) plugin version ≤ 1.7.3 using tools like WPScan or by inspecting plugin directories.
2. Obtain authenticated access: Register or log in as any WordPress user, including a Subscriber — the lowest privilege level available on sites with open registration.
3. Identify the vulnerable AJAX action: Inspect the plugin's JavaScript or PHP source to locate the unprotected AJAX action name registered via wp_ajax_ or wp_ajax_nopriv_ hooks.
4. Craft the malicious request: Send an authenticated HTTP POST request to /wp-admin/admin-ajax.php with the action parameter set to the vulnerable AJAX action and a custom value for the API token field (e.g., api_token=ATTACKER_CONTROLLED_VALUE).
5. Overwrite the API token: The server processes the request without authorization or nonce validation, replacing the legitimate administrator-configured translation API token with the attacker-supplied value, disrupting or hijacking translation services (WPScan).

• Network: Unexpected POST requests to /wp-admin/admin-ajax.php from low-privilege user sessions targeting the plugin's AJAX action, particularly from accounts that would not normally interact with translation settings.
• Logs: WordPress access logs showing authenticated AJAX requests to the translation plugin's action endpoint from Subscriber-level accounts; server-side logs reflecting changes to plugin option values in the database.
• Database: Unexpected changes to the wp_options table entry storing the Ray Enterprise Translation API token (e.g., lingotek_* or equivalent option key), especially if the value changes to an unrecognized string.
• Application Behavior: Translation functionality failing or routing through an unrecognized API account; administrator alerts about invalid or changed API credentials in the translation plugin settings panel.

No patched version of the Ray Enterprise Translation plugin is currently available. As an interim measure, site administrators should disable the plugin entirely until a fix is released, or restrict WordPress user registration to prevent untrusted users from obtaining authenticated access. Administrators should also audit the current API token value in the plugin settings and rotate the translation API credential if unauthorized changes are suspected. Monitoring AJAX requests to admin-ajax.php for anomalous activity from low-privilege accounts is also recommended (WPScan, GitHub Advisory).