CVE-2026-4683 Details
Description
The Smartcat Translator for WPML plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'routeData' REST endpoint in all versions up to, and including, 3.1.77. This makes it possible for unauthenticated attackers to overwrite the plugin's Smartcat API credentials (account ID, API secret key, hub key, API host, and hub host), effectively hijacking the translation service or causing a denial of service.
A vulnerability exists in the Smartcat Translator for WPML WordPress plugin, in all versions up to and including 3.1.77. The issue arises from a lack of proper capability checks on the 'routeData' REST endpoint, allowing unauthorized users to modify plugin settings. Specifically, unauthenticated attackers can overwrite the Smartcat API credentials stored by the plugin, including the account ID, API secret key, hub key, API host, and hub host. This could lead to unauthorized access to the translation service or cause a denial-of-service condition.
Users are advised to update the Smartcat Translator for WPML plugin to version 3.1.78 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 15, 2026CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Smartcat Translator | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | New CVE Received | [email protected] |