---
id: "CVE-2026-109931"
kind: "vulnerability"
aliases: ["CVE-2026-109931"]
title: "Infility Global WordPress plugin: unauthenticated visitors can overwrite translation settings"
severity: "low"
cvss: 3.7
epss: 0.00192
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["machine-translation", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "plugin-version-2.16.25-or-later"]
published_at: "2026-10-22T06:17:13+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:43:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109931", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-109931", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Infility Global WordPress plugin: unauthenticated visitors can overwrite translation settings

The Infility Global WordPress plugin before 2.16.25 has an AJAX action open to unauthenticated visitors with no authorisation or nonce check. Any visitor can overwrite a machine-translation configuration value used by a companion Infility Global plugin.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Infility Global plugin version in the WordPress admin Plugins screen or with `wp plugin list`
- Confirm whether the companion Infility Global plugin is installed and active

## Fix

- Update the Infility Global WordPress plugin to `2.16.25` or later
- Update the companion Infility Global WordPress plugin to a fixed version if one is available (unknown from sources)

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109931
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-109931

## From the sources

The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_