CVE-2026-14548CWE-862broken-access-control

CVE-2026-14548

Medium · published August 11, 2026

CVSS v3.1

6.5

EPSS

Percentile

21.5

In the wild

Unconfirmed

What it is

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00299 · 21.5th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2026-08-11T10:17Z

References (1)

https://wpscan.com/vulnerability/e1e0e945-db49-4e27-b143-ef3520a39db9/ · [email protected]

EPSS history

Timeline

11 AUG 06:00Z
Ray Enterprise Translation <= 1.7.3 - Subscriber+ Arbitrary API Token Update
cvelistv5