The vulnerability is a missing capability check in the plugin’s clean_options function, allowing an unauthenticated user to delete transients that store cached plugin options. This flaw results in loss of data specific to the translation settings, potentially disrupting website functionality and requiring reconfiguration of the plugin. The weakness is categorized as CWE‑862 and presents a moderate level of risk to the confidentiality and integrity of the plugin’s configuration data.

All installations of the Translate WordPress with Weglot – Multilingual AI Translation plugin with versions up to and including 5.1 are affected. The vendor is remyb92. Specific version numbers are not listed beyond the 5.1 cutoff, so any build prior to 5.2 remains vulnerable.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of below 1 % suggests a low probability of exploitation. The flaw is not listed in the CISA KEV catalog. An attacker can trigger the deletion by accessing the clean_options endpoint without authentication, but must discover the correct URL or injection vector to do so. Once exploited, the attacker removes cached options, leading to the loss of translation configuration data and a temporary service disruption.