CVE-2026-14549

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.

Score

CVSS 3.1 4.3 Medium

Status

Deferred - contact@wpscan.com

Published

2026-08-11

Last modified

2026-08-12

Weaknesses

CWE-862

Affected products

• Ray Enterprise Translation (Unknown)

References

• https://wpscan.com/vulnerability/3dd9bf3b-7fe4-4a58-ad05-1fc0bfb85413/