What is the CVSS score of CVE-2026-54805?

CVE-2026-54805 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

How to fix or mitigate CVE-2026-54805?

24 hours: Audit all WordPress installations for Falang Multilanguage plugin; document version and deployment scope; disable plugin on non-critical sites. 7 days: Implement Web Application Firewall rules to block privilege escalation attempts; restrict creation of new Subscriber-role accounts; enable logging on all user role changes. 30 days: Monitor for vendor release of version 1.4.3+; if released, upgrade immediately; if no timeline emerges, plan migration to alternative multilingual plugin solution.

Falang Multilanguage CVE-2026-54805

EUVD-2026-37641 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-06-17 Patchstack

WordPress Privilege Escalation Wordpress Plugin Falang Multilanguage

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress endpoint (AV:N), straightforward request (AC:L), requires authenticated Subscriber account (PR:L), no admin interaction (UI:N); role escalation yields full site control (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 11:52 vuln.today

DescriptionCVE.org

Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions.

AnalysisAI

Privilege escalation in the Falang Multilanguage WordPress plugin (versions <= 1.4.2) allows authenticated low-privileged users (Subscriber role) to elevate their permissions on affected sites. The flaw is rooted in improper privilege management (CWE-266) and carries a CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Falang Multilanguage is a WordPress translation plugin developed by sbouey (CPE: cpe:2.3:a:sbouey:falang_multilanguage). The root cause is CWE-266 (Incorrect Privilege Assignment), a class of weakness where the application assigns or accepts privileges beyond what a user role should be permitted. In WordPress plugins, this typically manifests as AJAX or REST endpoints that fail to verify the caller's capability (e.g., missing current_user_can() checks or insufficient nonce/role validation), allowing a Subscriber - the lowest authenticated role intended only for commenting/profile access - to invoke administrative actions or modify role/capability state.

RemediationAI

Patch available per vendor advisory - administrators should upgrade Falang Multilanguage to the latest version above 1.4.2 as published on WordPress.org, following guidance in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/falang/vulnerability/wordpress-falang-multilanguage-plugin-1-4-2-privilege-escalation-vulnerability (an exact fixed version is not independently confirmed in the provided data, so verify on WordPress.org before deploying). As compensating controls until patching, disable the Falang plugin entirely on sites where translation features are non-critical (loses multilingual functionality), or disable open WordPress user registration via Settings > General to remove the Subscriber-account precondition (blocks legitimate self-service signup), and restrict access to /wp-admin/admin-ajax.php and Falang-specific endpoints via WAF rules or web server ACLs to only authenticated Editor+ roles (may break legitimate plugin AJAX calls for low-privileged users).