The Infility Global WordPress plugin does not enforce authentication or a nonce on an AJAX request that updates a machine‑translation configuration value belonging to its companion plugin. As a result, any visitor who can reach the site can trigger the action and overwrite an organization’s translation settings, like a Google Translate API key, without any authorization.

WordPress sites that have the Infility Global plugin (any version prior to 2.16.25) together with its companion plugin (also any version prior to 2.16.25) are affected. All such installations are vulnerable until a newer version or a mitigation is applied.

The flaw is exploitable remotely via a simple HTTP request to the AJAX endpoint; no login or special privileges are required. The CVSS score is 3.7, indicating a medium severity, and the absence of any security check gives an attacker the ability to change critical configuration and potentially disrupt or abuse the translation service. The EPSS score is 0.00147, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, but the widespread web accessibility and ease of exploitation imply a significant risk.