CVE-2026-14548 — Ray Enterprise Translation <= 1.7.3 - Subscriber+ Arbitrary API Token Update
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, includ…
Published: 2026-08-11 · CVSS: 6.5 · CVSS 3.1
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7