Low severity · published Oct 22, 2026
CVE-2026-109931
Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update
New
3.7
CVSS
0.2%
EPSS
No
On KEV
Description
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IG
Infility Global ·
before 2.16.25 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109931
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109931
wpscan.com
https://wpscan.com/vulnerability/2d730144-fc13-4921-aa2f-1e0233b0a196/
More from Infility Global
8.8
CVE-2026-8163
Infility Global < 2.15.19 - Subscriber+ SQL Injection via order Parameter
6.8
CVE-2026-7842
Infility Global < 2.15.20 - Editor+ SQL Injection via orderby Parameter