Polylang CVE-2026-97278

Exploitation requires an authenticated high-privileged account (CVSS PR:H - typically a WordPress administrator or equivalent) able to reach the Polylang input path that deserializes untrusted data, and the untrusted serialized data must flow into a PHP unserialize() call. Meaningful impact beyond the deserialization itself additionally requires a usable POP gadget chain to exist in WordPress core, Polylang, or another installed component - the advisory does not confirm such a chain, which is a key limiting factor. Affects Polylang versions up to and including 3.8.9. No user interaction is required (UI:N), but the high-privilege gate substantially narrows the realistic attacker population.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) describes a network-reachable, low-complexity object-injection flaw that nonetheless requires high privileges (PR:H) - in a WordPress plugin context this typically means an administrator or equivalently high-privileged account must supply the untrusted serialized data. That high-privilege prerequisite is the single most important risk-dampening factor: an attacker who already holds admin rights on the site can usually inflict damage by many simpler means, so the marginal real-world severity is lower than the 7.2 'High' label suggests in isolation. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The CVE is NOT listed in CISA KEV and no public proof-of-concept is referenced, so there is no evidence of active exploitation - the only source is a single Patchstack advisory. The genuine danger materializes if the PR:H requirement can be downgraded in practice (e.g., chained with a lower-privilege flaw or a gadget chain reachable by contributors/authors), or if a suitable POP gadget chain exists in WordPress core or other installed plugins; object-injection impact is entirely dependent on available gadget chains, which the advisory does not confirm. Net assessment: a legitimate issue worth patching on a widely deployed plugin, but not an emergency given the high-privilege gate and absence of exploitation signals.

A high-privileged WordPress user (administrator, per the PR:H vector) submits crafted serialized PHP data to a Polylang input path that is passed to unserialize(), triggering PHP Object Injection. If a usable POP gadget chain is present in the WordPress stack, this can be leveraged for arbitrary file operations, SQL interaction, or code execution, compromising confidentiality, integrity, and availability. No public exploit code is referenced, so weaponization would require the attacker to identify a viable gadget chain themselves.