CVE-2026-97278
HighCVSS 7.2Summary
The Polylang plugin by WP SYNTEX up to version 3.8.9 contains an untrusted data deserialization vulnerability that allows Object Injection.
Risk Assessment
An attacker can exploit the vulnerability to execute arbitrary code on the server, potentially leading to full site and data compromise.
Recommendation
Immediately update the Polylang plugin to a patched version and avoid deserializing user-supplied data.
Other vulnerabilities in Polylang
See all- CVE-2026-97279Medium
The Polylang plugin in versions up to and including 3.8.9 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.
- CVE-2026-39783Medium
Missing Authorization vulnerability in WP SYNTEX Polylang allows retrieving embedded sensitive data. This issue affects Polylang from n/a through 3.8.7.
- CVE-2026-65458Medium
A vulnerability in Polylang and Polylang Pro (up to version 3.8.5) allows exposure of sensitive system information to unauthorized control spheres, enabling retrieval of embedded sensitive data.
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS