{"id":"CVE-2026-109931","kind":"vulnerability","aliases":["CVE-2026-109931"],"related":[],"title":"Infility Global WordPress plugin: unauthenticated visitors can overwrite translation settings","description":"The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.","summary":"The Infility Global WordPress plugin before 2.16.25 has an AJAX action open to unauthenticated visitors with no authorisation or nonce check. Any visitor can overwrite a machine-translation configuration value used by a companion Infility Global plugin.","severity":"low","cvss":3.7,"epss":0.00192,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["machine-translation","package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","plugin-version-2.16.25-or-later"],"how_to_check":"- Check the installed Infility Global plugin version in the WordPress admin Plugins screen or with `wp plugin list`\n- Confirm whether the companion Infility Global plugin is installed and active","fix":"- Update the Infility Global WordPress plugin to `2.16.25` or later\n- Update the companion Infility Global WordPress plugin to a fixed version if one is available (unknown from sources)","status":"open","published_at":"2026-10-22T06:17:13+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:43:25+00:00","updated_at":"2026-10-25T04:43:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:43:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Infility Global WordPress plugin to `2.16.25` or later\n- Update the companion Infility Global WordPress plugin to a fixed version if one is available (unknown from sources)","reach":"internet","title":"Infility Global WordPress plugin: unauthenticated visitors can overwrite translation settings","impact":"low","summary":"The Infility Global WordPress plugin before 2.16.25 has an AJAX action open to unauthenticated visitors with no authorisation or nonce check. Any visitor can overwrite a machine-translation configuration value used by a companion Infility Global plugin.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","machine-translation"],"confidence":0.6,"needs_auth":"no","worst_case":"Any visitor overwrites a machine-translation configuration value","analyst_note":"","how_to_check":"- Check the installed Infility Global plugin version in the WordPress admin Plugins screen or with `wp plugin list`\n- Confirm whether the companion Infility Global plugin is installed and active","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-version-2.16.25-or-later"],"who_is_affected":"Sites running the Infility Global WordPress plugin before 2.16.25 that also use its companion plugin for machine translation. The sources do not say whether the flaw is reachable on every site or only with the companion plugin active. Sites without the Infility Global plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000612,"input_tokens":3362,"output_tokens":552,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-109931':13A,16A '-2026':12A,15A '2.16.25':31B,69C,106C 'action':35B,81C 'ajax':34B,80C 'allow':86C 'authoris':42B,74C 'avail':82C 'belong':97C 'check':45B,77C 'companion':59B,100C 'configur':54B,95C 'cve':11A,14A 'global':2A,27B,61B,65C,102C 'infil':1A,26B,60B,64C,101C 'machin':18B,52B,93C 'machine-transl':17B,51B,92C 'nonc':44B,76C 'open':36B 'overwrit':8A,49B,90C 'packag':20B 'perform':72C 'plugin':4A,24B,29B,62B,67C,104C 'set':10A 'translat':9A,19B,53B,94C 'unauthent':5A,38B,84C 'use':56B 'user':85C 'valu':55B,96C 'visitor':6A,39B,47B,88C 'wordpress':3A,21B,23B,28B,66C,103C 'wordpress-plugin':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Infility Global WordPress plugin before 2.16.25 that also use its companion plugin for machine translation. The sources do not say whether the flaw is reachable on every site or only with the companion plugin active. Sites without the Infility Global plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T06:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109931","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109931","severity":null,"published_at":"2026-10-22T06:17:13+00:00","modified_at":"2026-10-22T15:16:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-109931","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109931","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}