Live › vulnerability › CVE-2026-109931
Go to dashboardThe Infility Global WordPress plugin before 2.16.25 has an AJAX action open to unauthenticated visitors with no authorisation or nonce check. Any visitor can overwrite a machine-translation configuration value used by a companion Infility Global plugin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Infility Global WordPress plugin before 2.16.25 that also use its companion plugin for machine translation. The sources do not say whether the flaw is reachable on every site or only with the companion plugin active. Sites without the Infility Global plugin can skip it.
No product ranges from the sources yet.
wp plugin list2.16.25 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
This page as .md · .json · in your agent: get_signal("CVE-2026-109931")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.