CVE-2026-14549: Ray Enterprise Translation <= 1.7.3 - Subscriber+ Language Addition and Deletion
Published Aug 11, 2026
·Updated
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.
Affected Software
1 affected component
Ray Ray Enterprise Translation (WordPress plugin)<=1.7.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ray Enterprise Translation WordPress pluginto a version that resolves this vulnerability.Fixed in 1.7.3 - Configuration
Update the plugin so the AJAX actions that add/delete configured languages perform proper WordPress capability checks and nonce verification before processing the request (the issue exists through plugin version 1.7.3).
Ray Enterprise Translation WordPress plugin (AJAX action for language add/delete) capability/nonce checks = enabled
Event History
Aug 11, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness