EUVD-2026-37641Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister Subscriber account on target
-
DeliveryAuthenticate to WordPress
-
ExploitSend crafted request to vulnerable Falang endpoint
-
ExecutionEscalate role to Administrator
-
PersistInstall malicious plugin or webshell
-
ImpactFull site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Requires (1) a WordPress site running the Falang Multilanguage plugin at version 1.4.2 or earlier, and (2) a valid authenticated session at the Subscriber role or higher (per CVSS PR:L) - typically obtainable on sites with open user registration enabled in WordPress (Settings > General > 'Anyone can register'). Exploitation is limited on sites where registration is disabled and Subscriber-tier credentials cannot be otherwise obtained, but no user interaction by an administrator is required (UI:N) and the attack is network-reachable over standard HTTP/HTTPS (AV:N). |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, with full CIA impact - consistent with a Subscriber-to-Admin escalation on a WordPress site. Real-world risk is meaningful because WordPress sites commonly permit open user registration at the Subscriber level, effectively turning PR:L into a near-unauthenticated condition for many deployments. EPSS data was not provided in the input, and the vulnerability is not listed in CISA KEV; no public POC was identified at time of analysis, so exploitation today appears opportunistic rather than mass-automated. Note: only a single Patchstack reference is available, so the exact vulnerable code path and presence of an upstream patch could not be independently corroborated from the provided data. |
| Exploit ScenarioDerived | An attacker registers a free Subscriber account on a WordPress site running Falang Multilanguage <= 1.4.2 (or compromises an existing low-privilege account via credential stuffing). They then send a crafted authenticated request to a Falang plugin endpoint that fails to enforce capability checks, escalating their account to Administrator and gaining full control of the site, including the ability to install malicious plugins or pivot to the underlying server. No public exploit identified at time of analysis, but the low attack complexity makes weaponization straightforward once the vulnerable endpoint is identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Privilege escalation in the Falang Multilanguage WordPress plugin (versions <= 1.4.2) allows authenticated low-privileged users (Subscriber role) to elevate their permissions on affected sites. The flaw is rooted in improper privilege management (CWE-266) and carries a CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
RemediationAI
Patch available per vendor advisory - administrators should upgrade Falang Multilanguage to the latest version above 1.4.2 as published on WordPress.org, following guidance in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/falang/vulnerability/wordpress-falang-multilanguage-plugin-1-4-2-privilege-escalation-vulnerability (an exact fixed version is not independently confirmed in the provided data, so verify on WordPress.org before deploying). As compensating controls until patching, disable the Falang plugin entirely on sites where translation features are non-critical (loses multilingual functionality), or disable open WordPress user registration via Settings > General to remove the Subscriber-account precondition (blocks legitimate self-service signup), and restrict access to /wp-admin/admin-ajax.php and Falang-specific endpoints via WAF rules or web server ACLs to only authenticated Editor+ roles (may break legitimate plugin AJAX calls for low-privileged users).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Falang Multilanguage is a WordPress translation plugin developed by sbouey (CPE: cpe:2.3:a:sbouey:falang_multilanguage). The root cause is CWE-266 (Incorrect Privilege Assignment), a class of weakness where the application assigns or accepts privileges beyond what a user role should be permitted. In WordPress plugins, this typically manifests as AJAX or REST endpoints that fail to verify the caller's capability (e.g., missing current_user_can() checks or insufficient nonce/role validation), allowing a Subscriber - the lowest authenticated role intended only for commenting/profile access - to invoke administrative actions or modify role/capability state.
Know when Falang Multilanguage gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable WordPress endpoint (AV:N), straightforward request (AC:L), requires authenticated Subscriber account (PR:L), no admin interaction (UI:N); role escalation yields full site control (C:H/I:H/A:H).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Privilege Escalation in Falang multilanguage <= 1.4.2 versions.
Executive ViewAI
The Falang Multilanguage WordPress plugin (versions 1.4.2 and earlier) contains a privilege escalation vulnerability allowing any authenticated subscriber-level user to elevate to higher administrative roles. With no vendor patch available and deployment across multiple WordPress installations typical in organizations using multilingual support, this creates immediate risk to data confidentiality, site integrity, and operational control. All organizations running this plugin require urgent mitigation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable the plugin entirely if not critical to operations; (2) Restrict Subscriber account creation and audit existing accounts for suspicious privilege changes; (3) Deploy WAF rules targeting privilege escalation payloads; (4) Increase monitoring frequency on administrative audit logs and user role modifications; (5) Limit Subscriber role access to non-sensitive site functions; (6) Plan parallel deployment of alternative multilingual solution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB