WordPress Ray Enterprise Translation plugin <= 1.7.3 - Subscriber+ Language Addition and Deletion vulnerability

Subscriber+ Language Addition and Deletion vulnerability discovered by Akshat Parikh in WordPress Plugin Ray Enterprise Translation versions = 1.7.3...

CVE-2026-14549

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages...

CVE-2026-14548

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

CVE-2026-14549 Ray Enterprise Translation <= 1.7.3 - Subscriber+ Language Addition and Deletion

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages...

CVE-2026-14549 Ray Enterprise Translation <= 1.7.3 - Subscriber+ Language Addition and Deletion

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages...

CVE-2026-14548

The Ray Enterprise Translation WordPress plugin (versions prior to 1.7.4 ) is vulnerable to an authorization bypass because it fails to perform capability or nonce checks on a specific AJAX action . This flaw allows any authenticated user, including those with low-level Subscriber privileges, to ...

EUVD-2026-55948

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages...

EUVD-2026-55947

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

CVE-2026-14549

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages...

CVE-2026-14548

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

CVE-2026-14549

The Ray Enterprise Translation WordPress plugin affects versions through 1.7.3 (or prior to 1.7.4) due to a lack of capability or nonce checks on one of its AJAX actions. This security flaw allows any authenticated user, including those with the lowest Subscriber privileges, to unauthorizedly add...

CVE-2026-14548 Ray Enterprise Translation <= 1.7.3 - Subscriber+ Arbitrary API Token Update

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

CVE-2026-14548 Ray Enterprise Translation <= 1.7.3 - Subscriber+ Arbitrary API Token Update

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

CVE-2026-14549: Missing Authorization

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages...

CVE-2026-14548: Missing Authorization

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value...

PT-2026-70066

Name of the Vulnerable Software and Affected Versions Ray Enterprise Translation versions prior to 1.7.4 Description The Ray Enterprise Translation WordPress plugin fails to perform capability or nonce checks on an AJAX action. This allows any authenticated user, such as those with Subscriber...

PT-2026-70065

Name of the Vulnerable Software and Affected Versions Ray Enterprise Translation versions prior to 1.7.4 Description The Ray Enterprise Translation WordPress plugin fails to perform capability or nonce checks on an AJAX action. This allows any authenticated user, such as those with Subscriber...

EUVD-2026-43075

Cross-Site Request Forgery CSRF vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4...

CVE-2026-15080

Cross-Site Request Forgery CSRF vulnerability in Drupal Ray Enterprise Translation allows Cross Site Request Forgery. This issue affects Ray Enterprise Translation versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.4, from 11.0.0 to 11.0.4...

CVE-2026-15080

The Lingotek Ray Enterprise Translation module for Drupal is vulnerable to Cross-Site Request Forgery (CSRF) . The module fails to protect several state-changing administrative routes, allowing an attacker to trick a privileged user into performing unauthorized actions, such as uploading or downl...