CVE-2026-14549: Ray Enterprise Translation <= 1.7.3 - Subscriber+ Language Addition and Deletion
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ray Enterprise Translation WordPress pluginto a version that resolves this vulnerability.Fixed in 1.7.3 - Configuration
Update the plugin so the AJAX actions that add/delete configured languages perform proper WordPress capability checks and nonce verification before processing the request (the issue exists through plugin version 1.7.3).
Ray Enterprise Translation WordPress plugin (AJAX action for language add/delete) capability/nonce checks = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14549?
CVE-2026-14549 is classified as a risk level of 33.
What systems are affected by CVE-2026-14549?
CVE-2026-14549 affects the Ray Enterprise Translation plugin for WordPress versions up to 1.7.3.
How do I fix CVE-2026-14549?
To mitigate CVE-2026-14549, update the Ray Enterprise Translation plugin to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-14549?
CVE-2026-14549 is a security vulnerability that allows any authenticated user to add or delete languages on the site.
Who can exploit CVE-2026-14549?
Any authenticated user, including Subscribers, can exploit CVE-2026-14549 due to the lack of capability checks.