Executive brief
The Ray Enterprise Translation WordPress plugin allows any authenticated user, including those with minimal privileges (Subscribers), to add or delete the site's configured languages through unsecured AJAX actions. This can corrupt the multilingual setup of a website, potentially disrupting site functionality and user experience across different language versions.
Technical details
The plugin contains an AJAX action handler for language management that fails to verify user capabilities or validate nonce tokens. An authenticated attacker without administrative privileges can send POST requests to wp-admin/admin-ajax.php with the lingotek_language action, using _method=POST to add languages or _method=DELETE to remove them. The vulnerability requires valid user authentication but no additional preconditions; however, impact is partially mitigated by guards preventing deletion of the last language or languages with assigned content. No patch is currently available.
Affected products
- Lingotek Ray Enterprise Translation through 1.7.3
Timeline
- 2026-08-08: disclosed
- 2026-08-11: advisory