CVE-2026-14549: Ray — AWAITING NVD

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Ray	pip	—	No patch
43.5K OpenSSF 5.8 620 dependents Pushed 2d ago 72% patched ~112d to patch Full package profile →

Do you use Ray? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

What should I do?

No patch available

Monitor for updates. Consider compensating controls or temporary mitigations.

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-14549?

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.

Is CVE-2026-14549 actively exploited?

No confirmed active exploitation of CVE-2026-14549 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-14549?

No patch is currently available. Monitor vendor advisories for updates.

What is the CVSS score for CVE-2026-14549?

No CVSS score has been assigned yet.

What are the technical details?

Original Advisory

The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.