CVE-2026-14548: 
WordPress vulnerability analysis and mitigation

CVE-2026-14548 is a Missing Authorization vulnerability in the Ray Enterprise Translation WordPress plugin (also known as lingotek-translation) that allows any authenticated user, including those with Subscriber-level access, to overwrite the administrator-configured translation API token with an arbitrary value. It affects all versions of the plugin through 1.7.3, with no known fixed version available at time of disclosure. The vulnerability was publicly disclosed on August 8, 2026, assigned by WPScan, and carries a CVSS v3.1 base score of 6.5 (Medium) (WPScan, Github Advisory).

The root cause is CWE-862 (Missing Authorization): the plugin fails to perform any capability or nonce checks on one of its AJAX action handlers, meaning WordPress's built-in access control mechanisms are entirely bypassed for that endpoint. Any authenticated user — even one with the lowest default role (Subscriber) — can send a crafted AJAX request to this unprotected action and supply an arbitrary value to replace the translation API token stored in the site's configuration. No elevated privileges, social engineering, or complex preconditions are required beyond having a valid WordPress account on the target site. A proof-of-concept is scheduled for public release on August 22, 2026, per WPScan's coordinated disclosure timeline (WPScan, Github Advisory).

Successful exploitation allows a low-privileged authenticated attacker to overwrite the administrator-configured translation API token, effectively hijacking or disrupting the site's translation service authentication. This could redirect translation API calls to an attacker-controlled service, expose content being translated, cause translation functionality to fail entirely, or enable unauthorized use of a legitimate API account (potentially incurring costs or data leakage). There is no direct confidentiality or availability impact scored, but integrity of the site's translation configuration is fully compromised (WPScan, Github Advisory).

CISA's SSVC assessment classifies exploitation status as "poc" (proof-of-concept), though the PoC has not yet been publicly released as of the disclosure date — WPScan plans to publish it on August 22, 2026. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.13–0.17%, indicating a low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (WPScan, Github Advisory).

1. Reconnaissance: Identify WordPress sites running the Ray Enterprise Translation (lingotek-translation) plugin at version 1.7.3 or earlier using tools such as WPScan, Shodan, or by inspecting publicly accessible plugin asset paths (e.g., /wp-content/plugins/lingotek-translation/).
2. Obtain authenticated access: Register or log in as any WordPress user, including a Subscriber-level account, on the target site.
3. Identify the vulnerable AJAX action: Inspect the plugin's JavaScript or source code to identify the unprotected AJAX action name (the specific action name will be detailed in the PoC scheduled for August 22, 2026).
4. Craft the malicious request: Send an authenticated HTTP POST request to wp-admin/admin-ajax.php with the identified action parameter and a custom api_token (or equivalent) parameter set to an attacker-controlled value, including the WordPress authentication cookies.
5. Overwrite the API token: The server processes the request without capability or nonce validation, storing the attacker-supplied token as the active translation API credential.
6. Achieve objective: The legitimate translation API token is replaced, disrupting translation services, redirecting API calls, or enabling unauthorized use of the translation service (WPScan).

• Network: Unexpected authenticated POST requests to wp-admin/admin-ajax.php from low-privileged user accounts, particularly with AJAX action parameters associated with the lingotek-translation plugin; unusual outbound API calls to unrecognized translation service endpoints.
• Logs: WordPress access logs showing POST requests to admin-ajax.php from Subscriber-level user sessions; application logs recording changes to the translation API token configuration outside of normal administrative activity.
• File System / Database: Unexpected changes to the translation API token value stored in the WordPress wp_options table (e.g., option name related to Lingotek/Ray Enterprise Translation API credentials); timestamps of option updates not matching known administrator activity.
• Process/Behavior: Translation functionality failing or routing to an unrecognized endpoint; unexpected API authentication errors from the legitimate translation service provider (WPScan).

No patched version of the Ray Enterprise Translation plugin is currently available. As an interim measure, site administrators should disable the plugin entirely until a fix is released, or restrict WordPress user registration and limit accounts to trusted users only (removing Subscriber-level access where not needed). Administrators should also monitor the wp_options table for unauthorized changes to the translation API token and rotate the API token with the translation service provider if compromise is suspected. When a patched version becomes available (above 1.7.3), upgrading immediately is strongly recommended (WPScan, Github Advisory).

The vulnerability was discovered and reported by security researcher Akshat Parikh (handle: SN1PER, website: akshatsecurity.com, Twitter: akshat127), and was verified by WPScan before public disclosure. No significant broader media coverage or notable community commentary beyond standard vulnerability database aggregation has been observed at this time (WPScan).