CVE-2026-109931: Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Infility Global WordPress pluginto a version that resolves this vulnerability.Fixed in 2.16.25
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated visitor can invoke the affected AJAX action; no authenticated WordPress account is required.
What can an attacker change?
An attacker can overwrite a machine-translation configuration value, specifically the Google Translate API key setting associated with a companion affected Infility Global WordPress plugin.
Which installations are affected?
Infility Global WordPress plugin versions before 2.16.25 are affected. The exposed AJAX action is available to unauthenticated users, so a default public-facing installation may be reachable by any visitor.