The vulnerability is a missing authorization flaw (CWE-862) in the Cool Plugins AI Translation for Polylang WordPress plugin. It allows an attacker to exploit incorrectly configured access control security levels, enabling unauthorized use of the plugin’s administrative functions. The impact is that an attacker who can reach the plugin’s interfaces may change translation settings or otherwise manipulate the plugin’s behavior without proper role validation.

Affected products include the WordPress AI Translation for Polylang plugin from Cool Plugins, versions from an unknown earliest version through 1.6.2. Owners of sites using any of these plugin versions are at risk.

The CVSS score of 5.4 indicates a moderate risk level. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via HTTP requests to the plugin’s endpoints, and would require that the site hosts the legacy plugin and that the attacker can send crafted requests. Because the flaw is an authorization bypass, it can be leveraged if the attacker can reach the plugin’s administrative functions, but it does not lead directly to remote code execution.