CVE-2026-109931

Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update

Unscored

The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.

Assigner
WPScan
Published
2026-10-22
Updated
2026-10-22
Reserved
2026-10-13

Affected

VendorProductVersions
Unknown Infility Global < 2.16.25 (affected)
others: unaffected

References

Full CVE JSON record (5.2)

API · GitHub · cve.org

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Infility Global",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "2.16.25",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Enrico Marcolini"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Claudio Marchesini"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Dottor Marc"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-22T06:00:17.257Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/2d730144-fc13-4921-aa2f-1e0233b0a196/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Infility Global \u003c 2.16.25 - Unauthenticated Google Translate API Key Update",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-109931",
    "datePublished": "2026-10-22T06:00:17.257Z",
    "dateReserved": "2026-10-13T10:56:36.648Z",
    "dateUpdated": "2026-10-22T06:00:17.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}