Technical impact
The vulnerability is a Missing Authorization flaw that allows an attacker to bypass intended access controls within the Jiro Sasamoto Ray Enterprise Translation plugin. Identified as CWE‑862, the flaw permits unauthorized users to access or manipulate translation content that should be restricted, potentially leading to data disclosure or tampering. This exploit impacts the confidentiality and integrity of translation assets managed by the plugin.
Affected Systems
The flaw affects the Ray Enterprise Translation plugin for WordPress, specifically all releases from the earliest available version up through version 1.7.2. The plugin is distributed by Jiro Sasamoto and is commonly used to manage translations within the lingotek‑translation WordPress environment.
Risk and Exploitability
The CVSS score of 5.4 indicates a moderate severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via the WordPress web interface: an attacker who can navigate to the plugin’s administration pages may exploit the missing authorization check to gain unauthorized access, even without prior authentication to the site.
EUVD