Unauthorized Data Modification in Smartcat Translator for WPML Plugin by WordPress

CVE-2026-4683

What is CVE-2026-4683?

The Smartcat Translator for WPML plugin is susceptible to unauthorized data modification resulting from an overlooked capability check on the 'routeData' REST endpoint. This flaw is present in all versions up to and including 3.1.77. As a result, attackers without authentication can change sensitive data such as the API credentials used for Smartcat services. This breach can lead to service hijacking, enabling attackers to disrupt translation services or compromise user data.

References