CVE-2026-14549 in Ray Enterprise Translation Plugin
Summary
by MITRE • 08/11/2026
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The Ray Enterprise Translation WordPress plugin version 1.7.3 and earlier contains a critical security vulnerability that stems from insufficient authentication and authorization controls within its AJAX handling mechanisms. This flaw allows any authenticated user account, regardless of role level including low-privilege subscribers, to manipulate the site's language configuration through unauthorized administrative actions. The vulnerability specifically affects one of the plugin's AJAX endpoints that lacks proper capability verification or nonce validation, creating an exploitable path for privilege escalation and configuration modification.
This security weakness directly relates to CWE-863, which describes "Incorrect Authorization" where an application fails to properly verify that an actor has sufficient privileges to perform a requested operation. The vulnerability enables unauthorized language management actions including adding new languages to the site or deleting existing ones from the configured language set. Such modifications can significantly impact website functionality and user experience by altering content delivery methods, breaking multilingual features, or potentially exposing the site to additional attack vectors through misconfigured language settings.
The operational impact of this vulnerability extends beyond simple configuration changes as it provides malicious users with the ability to fundamentally alter how a website presents content to visitors. When subscribers or other low-privilege users can modify language configurations, they effectively gain administrative control over multilingual aspects of the site, which may include changing default languages, removing support for specific locales, or adding potentially malicious language entries that could be used in subsequent attacks. This represents a significant escalation of privileges within the WordPress ecosystem where user role boundaries are typically maintained.
From an ATT&CK perspective, this vulnerability aligns with techniques involving privilege escalation and persistence through application-level modifications. The ability to add or delete languages can be leveraged for further attacks including language-based phishing attempts, content manipulation for social engineering purposes, or creating confusion among users about the site's legitimate functionality. Security controls should focus on implementing proper nonce validation and capability checks for all AJAX endpoints within WordPress plugins, ensuring that only users with appropriate administrative privileges can perform critical configuration changes.
Mitigation strategies should include immediate plugin updates to versions that address this authorization flaw, implementation of additional security monitoring for unauthorized language configuration changes, and enforcement of strict capability checks in custom AJAX handlers. Organizations should also consider implementing web application firewalls with rules specifically targeting unauthorized administrative actions and conduct regular audits of plugin permissions and capabilities to prevent similar vulnerabilities from being introduced through third-party components.