CVE-2026-109931

Published Oct 22, 2026

Last updated 3 days ago

CVSS low 3.7

Overview

Description
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
Source
contact@wpscan.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
3.7
Impact score
1.4
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Severity
LOW

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-862

Social media

Hype score
Not currently trending

References

Sources include official advisories and independent security research.