CVE-2026-14549: 
WordPress vulnerability analysis and mitigation

CVE-2026-14549 is a Missing Authorization vulnerability in the Ray Enterprise Translation WordPress plugin (also known as lingotek-translation) affecting all versions through 1.7.3. The flaw allows any authenticated user — including those with the low-privilege Subscriber role — to add or delete the site's configured languages via an unprotected AJAX action. It was publicly disclosed on August 8, 2026, with the CVE record published on August 11, 2026, and assigned by WPScan. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (WPScan, GitHub Advisory).

The root cause is classified as CWE-862 (Missing Authorization): the plugin fails to perform any capability or nonce verification on at least one of its WordPress AJAX action handlers, which is a common pattern for broken access control in WordPress plugins (WPScan). An attacker only needs a valid authenticated session (Subscriber-level or higher) to send crafted AJAX requests directly to the vulnerable endpoint, bypassing any intended access restrictions. No complex exploitation technique is required — the attack vector is network-accessible, attack complexity is low, and no user interaction is needed (GitHub Advisory). A proof-of-concept was scheduled for public release on August 22, 2026, to allow time for users to update (WPScan).

Successful exploitation allows any authenticated user with at least Subscriber-level access to arbitrarily add or remove the site's configured languages, disrupting multilingual site functionality and potentially degrading the user experience for legitimate visitors. The integrity impact is limited to language configuration data, with no confidentiality or availability impact assessed. While not a critical system compromise, this could be used to sabotage localization settings on multilingual WordPress sites or as part of a broader site defacement effort (WPScan, GitHub Advisory).

CISA's SSVC assessment classifies exploitation status as "poc" (proof-of-concept), indicating PoC-level exploit details exist or are anticipated, though WPScan noted the PoC would not be published until August 22, 2026 (WPScan). There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.13–0.15%, reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable per CISA's SSVC assessment, as it requires an authenticated session (GitHub Advisory).

1. Obtain Authenticated Access: Register or obtain credentials for a low-privilege account (e.g., Subscriber role) on the target WordPress site running Ray Enterprise Translation ≤ 1.7.3.
2. Identify the Vulnerable AJAX Endpoint: Enumerate the plugin's registered WordPress AJAX actions (e.g., by reviewing plugin source code or intercepting legitimate requests) to identify the action handler that lacks capability and nonce checks.
3. Craft Malicious AJAX Request: Construct an HTTP POST request to wp-admin/admin-ajax.php with the appropriate action parameter targeting the vulnerable handler, along with parameters to specify adding or deleting a language.
4. Submit the Request: Send the crafted request using a tool such as curl or Burp Suite while authenticated as a Subscriber, e.g.: POST /wp-admin/admin-ajax.php with body action=<vulnerable_action>&language=<target_language>.
5. Verify Impact: Confirm that the site's configured languages have been modified (added or deleted) without any authorization error, demonstrating successful exploitation (WPScan).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php from Subscriber-level user accounts, particularly with action parameters associated with language management functions in the Ray Enterprise Translation plugin.
• Logs: WordPress access logs showing repeated AJAX requests to admin-ajax.php from low-privilege user accounts at unexpected times; WordPress debug logs showing language configuration changes not initiated by administrators.
• Application: Unexpected additions or deletions of configured site languages in the WordPress language settings; audit trail entries (if a logging plugin is installed) showing language configuration changes attributed to Subscriber-level users.

Site administrators should update the Ray Enterprise Translation plugin to a version newer than 1.7.3 as soon as a patched release becomes available; the WPScan advisory notes "No known fix" at the time of publication, so monitoring the plugin's update channel is essential (WPScan). As an interim workaround, administrators should restrict user registration and minimize the number of authenticated users with Subscriber-level access, and consider temporarily deactivating the plugin if multilingual functionality is not critical. Monitoring AJAX requests for unauthorized language modifications can help detect exploitation attempts in the interim (GitHub Advisory).

The vulnerability was discovered and submitted by security researcher Akshat Parikh and verified by WPScan (WPScan). No significant broader media coverage or notable community commentary beyond the standard vulnerability disclosure process has been identified at this time.