CVE-2026-14548: Ray Subscribers can hijack API

CISO Take

A missing capability and nonce check in the Ray Enterprise Translation WordPress plugin lets any authenticated user — even the lowest-privilege Subscriber role — overwrite the site's configured translation API token via an AJAX action, with full integrity compromise of that setting but no confidentiality or availability impact (CVSS 6.5, C:N/I:H/A:N). This is a generic WordPress broken-access-control bug, not a core AI/ML pipeline vulnerability: despite the 'Ray' name, it is unrelated to the Anyscale Ray ML framework, and the package metadata attached to this record (620 downstream dependents, OpenSSF score 5.8, ai_category ml_ops) reflects that unrelated pip package, not this plugin's real footprint. Exploitation likelihood is low — EPSS is 0.00174 (~0.17%), there's no public PoC, no Nuclei template, and it's not in CISA KEV (SSVC: TRACK) — but the barrier to entry is trivial for sites with open self-registration, since any Subscriber account suffices. CISOs running this plugin should confirm a patched release via the WPScan advisory, and in the meantime restrict self-registration or Subscriber capabilities and audit the current API token value for unauthorized changes. This is a standard WordPress access-control finding, not an AI threat-intel priority — no ATLAS technique or AI-specific detection applies.

Sources: NVD EPSS wpscan.com

What is the risk?

Medium severity (CVSS 6.5), integrity-only impact (C:N/I:H/A:N) — the flaw lets a low-privileged authenticated user (PR:L, no user interaction, network vector) overwrite a single configuration value, not execute code or read data. EPSS (0.00174) indicates minimal real-world exploitation activity, there is no public exploit or Nuclei template, it is absent from CISA KEV, and CISA's SSVC decision is TRACK (routine patching timeline, not urgent). Practical risk is bounded to sites that allow open user self-registration or otherwise grant Subscriber-level accounts to untrusted parties.

How does the attack unfold?

Initial Access

Attacker obtains a low-privileged Subscriber account on the WordPress site, e.g. via open self-registration.

Exploitation

Attacker calls the plugin's vulnerable AJAX action directly with a crafted token value; no capability or nonce check blocks the request.

AML.T0049

Impact

The site's translation API token is overwritten, breaking legitimate translation functionality or routing usage to attacker-controlled credentials.

Initial Access

Attacker obtains a low-privileged Subscriber account on the WordPress site, e.g. via open self-registration.

Exploitation

Attacker calls the plugin's vulnerable AJAX action directly with a crafted token value; no capability or nonce check blocks the request.

AML.T0049

Impact

The site's translation API token is overwritten, breaking legitimate translation functionality or routing usage to attacker-controlled credentials.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Ray	pip	—	No patch
43.9K OpenSSF 5.8 635 dependents Pushed 5d ago 68% patched ~145d to patch Full package profile →

Do you use Ray? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A None

What should I do?

1 step

Check the vendor changelog / WPScan advisory (wpscan.com) for a patched Ray Enterprise Translation release and update immediately once available — no patched version is currently listed. Until patched, disable or remove the plugin, disable open self-registration or restrict which roles can register, and add a WAF/reverse-proxy rule blocking non-admin calls to the plugin's AJAX action. Audit the current translation API token for unauthorized changes and rotate it as a precaution; monitor admin-ajax.php access logs for calls to this action from Subscriber-level accounts.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Plugin API

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-14548?

A missing capability and nonce check in the Ray Enterprise Translation WordPress plugin lets any authenticated user — even the lowest-privilege Subscriber role — overwrite the site's configured translation API token via an AJAX action, with full integrity compromise of that setting but no confidentiality or availability impact (CVSS 6.5, C:N/I:H/A:N). This is a generic WordPress broken-access-control bug, not a core AI/ML pipeline vulnerability: despite the 'Ray' name, it is unrelated to the Anyscale Ray ML framework, and the package metadata attached to this record (620 downstream dependents, OpenSSF score 5.8, ai_category ml_ops) reflects that unrelated pip package, not this plugin's real footprint. Exploitation likelihood is low — EPSS is 0.00174 (~0.17%), there's no public PoC, no Nuclei template, and it's not in CISA KEV (SSVC: TRACK) — but the barrier to entry is trivial for sites with open self-registration, since any Subscriber account suffices. CISOs running this plugin should confirm a patched release via the WPScan advisory, and in the meantime restrict self-registration or Subscriber capabilities and audit the current API token value for unauthorized changes. This is a standard WordPress access-control finding, not an AI threat-intel priority — no ATLAS technique or AI-specific detection applies.

Is CVE-2026-14548 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-14548, increasing the risk of exploitation.

How to fix CVE-2026-14548?

Check the vendor changelog / WPScan advisory (wpscan.com) for a patched Ray Enterprise Translation release and update immediately once available — no patched version is currently listed. Until patched, disable or remove the plugin, disable open self-registration or restrict which roles can register, and add a WAF/reverse-proxy rule blocking non-admin calls to the plugin's AJAX action. Audit the current translation API token for unauthorized changes and rotate it as a precaution; monitor admin-ajax.php access logs for calls to this action from Subscriber-level accounts.

What systems are affected by CVE-2026-14548?

This vulnerability affects the following AI/ML architecture patterns: None — generic WordPress CMS plugin; no AI/ML training, inference, RAG, or agent pipeline component is affected.

What is the CVSS score for CVE-2026-14548?

CVE-2026-14548 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

None — generic WordPress CMS plugin; no AI/ML training, inference, RAG, or agent pipeline component is affected

What are the technical details?

Original Advisory

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value.

Exploitation Scenario

An attacker registers (or already holds) a low-privileged Subscriber account on a WordPress site running the vulnerable plugin version — trivial on sites with open self-registration. They send a crafted AJAX POST request directly to the plugin's translation-token action, which performs no capability or nonce check, and overwrite the site's configured API token with an arbitrary value. The legitimate translation integration then breaks or begins using attacker-supplied credentials, disrupting the feature and potentially exposing the site to further abuse if the token field also influences the target API endpoint.