CVE-2026-97278
7.2HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-502
Impact
Authenticated high-privilege attackers can execute arbitrary code, modify files, or trigger denial of service via PHP object injection. They need administrative access to the WordPress site to exploit it.
Root cause
The plugin unsafely deserializes untrusted user input without proper sanitization.
Affected systems
WP SYNTEX Polylang through 3.8.9
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Polylang to a version newer than 3.8.9 once available. If patching must wait, restrict WordPress administrative access or temporarily deactivate the Polylang plugin.
$ wp plugin update polylangAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.