My WP Translate <= 1.0.3 - Unprotected AJAX Actions

The My WP Translate plugin for WordPress is vulnerable to an authorization bypass weakness in versions up to, and including, 1.0.3. This is due to missing capability checks and nonce validation on the following functions: ajax_translation_panel(), ajax_save_translation(), ajax_add_plugin(), ajax_remove_plugin(), ajax_save_state(), ajax_import_strings(), and ajax_update_export_code(). This makes it possible for low-privileged authenticated attackers to perform a wide variety of actions such as adding or removing plugins. This can also be exploited via Cross-Site Request Forgery.