The Smartcat Translator for WPML plugin allows unauthenticated attackers to call the 'routeData' REST endpoint without any capability check. Due to this missing authorization control (CWE-862), an attacker can overwrite the plugin’s Smartcat API credentials—account ID, API secret key, hub key, API host, and hub host. This permits the attacker to hijack the translation service or disrupt it by configuring invalid credentials, effectively disabling translation functionality or redirecting traffic to an attacker-controlled endpoint.

WordPress sites that have the Smartcat Translator for WPML plugin installed version 3.1.77 or earlier. The vulnerable product is Smartcatai's Smartcat Translator for WPML.

The CVSS score of 6.5 reflects moderate severity. Because the endpoint is exposed over standard REST routes, the exploit requires only an unauthenticated HTTP request, which can be performed by any user, even without a WordPress account. The lack of EPSS data and absence from the KEV catalog indicates that while exploitation is technically straightforward, no active or widespread attacks are currently documented. Nevertheless, the ability to change API credentials is a serious privilege‑escalation risk and should be addressed promptly.