What is the CVSS score of CVE-2026-65458?

CVE-2026-65458 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Polylang CVE-2026-65458

Q: Which versions of Polylang are affected by CVE-2026-65458?

Sensitive data exposure in Polylang WordPress plugin (versions <= 3.8.5) allows authenticated Contributors to access information beyond their authorization scope.

EUVD-2026-48223 MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-07-23 Patchstack

GHSA-gmph-4533-hxfg

WordPress Information Disclosure Wordpress Plugin Polylang

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Requires low-privilege Contributor authentication (PR:L) over the network; only limited confidentiality impact applies, with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:27 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

MEDIUM 4.3

DescriptionCVE.org

Contributor Sensitive Data Exposure in Polylang <= 3.8.5 versions.

AnalysisAI

Sensitive data exposure in Polylang WordPress plugin (versions <= 3.8.5) allows authenticated Contributors to access information beyond their authorization scope. The vulnerability, classified under CWE-497, enables low-privileged authenticated users - specifically those holding the WordPress Contributor role - to read sensitive data they should not be permitted to view. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.

Technical ContextAI

Polylang (CPE: cpe:2.3:a:chouby:polylang:*:*:*:*:*:*:*:*) is a widely-deployed WordPress plugin that enables multilingual content management. CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) describes the root cause: the plugin surfaces sensitive data through an insufficiently access-controlled mechanism accessible to Contributors. In WordPress, the Contributor role is a low-privilege authenticated role that can draft posts but cannot publish or manage site settings, making any data reachable by Contributors beyond their designated scope a privilege boundary violation. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms this is exploitable over the network with no special conditions beyond holding a Contributor account.

RemediationAI

Upgrade the Polylang plugin to the first release beyond version 3.8.5 - the exact patched version number is not confirmed in the available data; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/polylang/vulnerability/wordpress-polylang-plugin-3-8-5-sensitive-data-exposure-vulnerability) and the WordPress plugin repository for the latest patched release. As a compensating control pending upgrade, administrators should audit and restrict Contributor account registration: disable open contributor self-registration if not operationally required, as this narrows the exploitable attacker pool to trusted internal users only. Sites that must allow external Contributors should review WordPress user roles and consider temporarily demoting or suspending untrusted Contributor accounts until patched. Note that role restriction is a risk-reduction measure, not a fix - it does not eliminate the underlying access control flaw.