CVE-2026-109931
Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update
- State
- Published
- Severity
- 3.7 Low
- Published
- Oct 22, 2026
- Updated
- Oct 22, 2026
- Reserved
- Oct 13, 2026
Description
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.7 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
Infility GlobalUnknown |
|
References
- https://wpscan.com/vulnerability/2d730144-fc13-4921-aa2f-1e0233b0a196/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.