CVE-2026-39783
MediumCVSS 4.3Summary
Missing Authorization vulnerability in WP SYNTEX Polylang allows retrieving embedded sensitive data. This issue affects Polylang from n/a through 3.8.7.
Risk Assessment
An unauthorized person may gain access to sensitive data embedded in the system, potentially leading to a breach of information confidentiality.
Recommendation
Update the Polylang plugin to the latest version that includes the fix. Check for other authorization-related risks.
Other vulnerabilities in Polylang
See all- CVE-2026-97279Medium
The Polylang plugin in versions up to and including 3.8.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.
- CVE-2026-65458Medium
A vulnerability in Polylang and Polylang Pro (up to version 3.8.5) allows exposure of sensitive system information to unauthorized control spheres, enabling retrieval of embedded sensitive data.
Original NVD description (English source)
Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS