Security Alert Summary
The Smartcat Translator for WPML plugin for WordPress contains a missing capability check on its routeData REST endpoint in all versions up to and including 3.1.77. This allows unauthenticated attackers to modify the plugin’s Smartcat API credentials (account ID, API secret key, hub key, API host, and hub host), which can be used to hijack translation traffic or cause a denial of service for translation functionality.
CVE Details
- CVE ID: CVE-2026-4683
- Affected component: Smartcat Translator for WPML plugin for WordPress
- Affected versions: All versions up to and including 3.1.77
- Published: May 15, 2026 at 09:16:16 AM
- Last modified: May 15, 2026 at 02:09:15 PM
- CVSS v3.1: Base Score 6.5, Medium
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Authentication / Privileges / User Interaction:
Authentication required: NonePrivileges required: NoneUser interaction: NoneAttack Vector: Network; Attack Complexity: Low; Scope: Unchanged
- Primary impact:
Confidentiality: NoneIntegrity: Low (ability to modify plugin API credentials)Availability: Low (potential to disrupt translation functionality)
- Weakness: CWE-862 (Missing Authorization)
Technical Details
The vulnerability is caused by a missing capability check on the plugin’s routeData REST endpoint. Because the endpoint does not validate that the caller has the required capabilities, an unauthenticated attacker can submit requests that overwrite the plugin’s Smartcat API credentials: account ID, API secret key, hub key, API host, and hub host.
By replacing these credentials or pointing the plugin to attacker-controlled hosts, an attacker can redirect translation requests, degrade or disable translation services, or otherwise interfere with normal translation workflows. The description explicitly identifies the lack of an authorization check on the routeData endpoint as the root cause; no additional checks or authentication are required for an attacker to trigger the modification.
How This Could Impact Your Website
Consider a small organization where the site owner configures the Smartcat integration, an internal content editor uses WPML to manage translations, and an external translator or contractor relies on automated translation workflows. If an attacker overwrites the plugin's Smartcat credentials or changes the API host:
- Translation jobs may fail or be routed to a malicious host, disrupting workflows and causing delays for editors and external translators.
- Translated content could be altered or withheld, which may impair communication with customers or partners who rely on translated pages.
- Service disruption to translation features can increase administrative overhead while staff diagnose broken functionality.
If you're unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Audit and reduce unnecessary user roles and capabilities, especially for contributors and editors.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual POSTs to REST endpoints and unexpected changes to plugin settings or credentials.
If you'd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/smartcat-wpml/trunk/includes/Controllers/CallbackController.php#L10
- https://plugins.trac.wordpress.org/browser/smartcat-wpml/trunk/includes/Services/Plugin/Router.php#L18
- https://plugins.trac.wordpress.org/changeset/3524382/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6a9397ed-eddf-466b-b810-1e2f45afd291?source=cve
