Executive brief
The Ray Enterprise Translation WordPress plugin is used to manage translations on websites through integration with a translation API service. A flaw in the plugin allows any logged-in user, even those with minimal permissions (Subscribers), to change the administrator's translation API credentials to malicious values, disrupting the site's translation functionality and potentially redirecting translation requests to an attacker-controlled service.
Technical details
The Ray Enterprise Translation plugin fails to implement capability and nonce checks on the lingotek_authorization_action AJAX endpoint, allowing any authenticated user to bypass access controls and modify the stored API token. The vulnerability lies in the missing authorization enforcement in the AJAX handler; attackers supply the new token value via the Token request header without needing valid credentials. Exploitation requires only an authenticated session (even Subscriber level) and network access to the WordPress site; no user interaction or admin approval is necessary. An attacker can overwrite the legitimate API token with an arbitrary value, breaking the site's connection to the Lingotek/Ray Enterprise translation service or redirecting it to a malicious service. The plugin stores the supplied token without validation against the upstream API, making the attack effective immediately.
Affected products
- Lingotek Ray Enterprise Translation through 1.7.3
Timeline
- 2026-08-08: disclosed
- 2026-08-11: other: CVE-2026-14548 published