CVE-2026-39783
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Missing Authorization vulnerability in WP SYNTEX Polylang allows retrieving embedded sensitive data. This issue affects Polylang from n/a through 3.8.7.
Risk Assessment
An unauthorized person may gain access to sensitive data embedded in the system, potentially leading to a breach of information confidentiality.
Recommendation
Update the Polylang plugin to the latest version that includes the fix. Check for other authorization-related risks.
Other vulnerabilities in Polylang
See all- CVE-2026-97278High
The Polylang plugin by WP SYNTEX up to version 3.8.9 contains an untrusted data deserialization vulnerability that allows Object Injection.
- CVE-2026-97279Medium
The Polylang plugin in versions up to and including 3.8.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.
- CVE-2026-65458Medium
A vulnerability in Polylang and Polylang Pro (up to version 3.8.5) allows exposure of sensitive system information to unauthorized control spheres, enabling retrieval of embedded sensitive data.
Original NVD description (English source)
Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS