[ CVE-2026-109931 · Published 22 Oct 2026 ]
Vulnerability in Unknown Infility Global
CVSS 3.7
EPSS <1%No fix listed yet
[ Description ]Official description
The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthenticated users, allowing any visitor to overwrite a machine-translation configuration value belonging to a companion Infility Global WordPress plugin before 2.16.25.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.