CVE-2026-14548 is a missing authorization vulnerability (CWE-862) in the Ray Enterprise Translation WordPress plugin through version 1.7.3. The plugin does not verify user capabilities or nonce tokens on one of its AJAX actions, enabling any authenticated user, regardless of privilege level, to overwrite the translation API token set by the administrator with an arbitrary value. This could lead to unauthorized manipulation of the translation service configuration.

An attacker with any authenticated user account, including low-privilege roles such as Subscribers, can overwrite the administrator's translation API token. This may allow the attacker to redirect translation requests or disrupt translation functionality by using a malicious or invalid API token. The impact is limited to users who have authenticated access to the WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user roles to trusted users only and monitor for suspicious changes to the translation API token configuration. Avoid granting unnecessary authenticated access to untrusted users.