CVE-2025-8423

Name of the Vulnerable Software and Affected Versions My WP Translate versions prior to 1.2

Description Unauthorized modification of data is possible due to a missing capability check in the mtswpt remove plugin() and ajax update export code() functions. Authenticated attackers with Subscriber-level access or higher can read and delete arbitrary WordPress options, potentially leading to a denial of service.

Recommendations Update My WP Translate to version 1.2 or later. As a temporary mitigation, restrict access to the mtswpt remove plugin() and ajax update export code() functions.