Polylang CVE-2026-39783

Exploitation requires an authenticated account with at least low privileges on the target WordPress site (CVSS PR:L) - it is not exploitable by fully unauthenticated visitors. The flaw is a missing authorization/capability check in Polylang versions up to and including 3.8.7, allowing the authenticated user to retrieve embedded sensitive data outside their intended access level. No user interaction is required (UI:N) and attack complexity is low (AC:L). The practical limiting factor is the need for a valid account, so sites that permit open user registration (e.g. default subscriber signup) or that have many low-trust users face materially higher exposure than sites restricting account creation.

This is a moderate-severity, authorization-bypass (CWE-862) issue in the Polylang WordPress plugin, scored CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The CVSS vector signals network-reachable, low-complexity exploitation but requires an existing low-privilege authenticated account (PR:L) and yields only limited confidentiality impact (C:L), with no integrity or availability effect. No EPSS score, SSVC decision, KEV listing, or POC reference was supplied in the input, so exploitation probability cannot be quantified from the data provided. There is no public exploit identified at time of analysis and no evidence of active exploitation. On balance this is a real but lower-priority issue: the authentication requirement and read-only, partial-confidentiality impact make it far less urgent than an unauthenticated data-exposure flaw, and it should be patched during routine maintenance rather than as an emergency. The absence of EPSS/KEV data is a gap, not a signal of safety; given it was reported by Patchstack, treat exploitation likelihood as low-to-moderate pending further telemetry.

An attacker who holds any low-privilege authenticated account on the WordPress site (for example a subscriber or contributor on a site allowing open registration) sends crafted requests to a Polylang endpoint that fails to enforce an authorization check, and reads embedded sensitive data they should not be able to access. The low attack complexity (AC:L) means no special timing or conditions are needed once authenticated. No public exploit code is identified at time of analysis.