The My WP Translate plugin contains a missing capability check in its ajax_import_strings routine, allowing any authenticated user with Subscriber level or higher to update arbitrary WordPress options. An attacker could modify the default registration role to administrator and enable user registration, creating new administrator accounts from the front‑end. The flaw is a classic authorization bypass (CWE‑862) and can elevate an attacker’s privileges from a low‑tier user to a site admin.

The vulnerability affects the My WP Translate plugin (MyThemesShop) in all releases up to and including version 1.1, which runs on WordPress installations. Any WordPress site using this plugin is at risk unless the plugin is updated or removed.

The CVSS score of 8.8 classifies the issue as a high‑severity vulnerability. However, the EPSS score of less than 1% indicates that exploitation is currently considered unlikely. The attack requires that the attacker is already authenticated, so the risk is primarily to sites with permissive subscriber access. The flaw is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been documented. Overall, the threat remains significant for sites that allow subscriber access and use the vulnerable plugin version.