PT-2025-37130 · WordPress · My-Wp-Translate

Arkadiusz Hydzik · Published 2025-09-11 · Updated 2025-09-16 · CVE-2025-8425

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions My WP Translate plugin for WordPress versions up to and including 1.1

Description The My WP Translate plugin for WordPress is susceptible to unauthorized data modification, potentially leading to privilege escalation. A missing capability check within the ajax import strings() function allows authenticated attackers with Subscriber-level access or higher to modify arbitrary options on a WordPress site. This can be exploited to elevate user privileges, such as changing the default registration role to administrator and enabling user registration for malicious purposes, ultimately granting attackers administrative access.

Recommendations Versions prior to 1.1: Update to a version beyond 1.1 to address the issue. Version 1.1: Update to a version beyond 1.1 to address the issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-8425

Affected Products

My-Wp-Translate

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-8425 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ef46b08f-455a-4c61-81ac-10af19b16980?source=cve · Note
• https://twitter.com/cracbot/status/1967906348214993180 · Twitter Post
• https://plugins.trac.wordpress.org/browser/my-wp-translate/tags/1.1/admin/class-my-wp-translate-admin.php#L1116 · Note