Vulnerability · Published Oct 22, 2026 · Assigned by WPScan
CVE-2026-109931Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update
Low 3.7
In plain English
A low-severity missing authorization in Infility Global from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.2%top 84.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Infility Global | 0 – before 2.16.25 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/2d730144-fc13-4921-aa2f-1e0233b0a196/ exploit, vdb-entry, technical-description