Polylang <= 3.8.10 - Authenticated (Editor+) PHP Object Injection via Term Description
- ID
- WPSEC-2026-0893
- Plugin
- Polylang (polylang)
- Affected
- all versions before 3.8.11
- Remediation
- Update to 3.8.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-502
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- Polylang on WPSec AttackSurface
- Fix released
- Published
Description
The Polylang plugin for WordPress is vulnerable to PHP Object Injection via the descriptions of its language and translation-group taxonomy terms in all versions up to, and including, 3.8.10, due to these descriptions being passed to maybe_unserialize() without restricting allowed classes, and to a disallowed-type check that could be bypassed, for example with leading whitespace. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, but if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://wpsec.com/vuln/WPSEC-2026-0893/
- https://plugins.svn.wordpress.org/polylang/tags/3.8.11/
- https://wordpress.org/plugins/polylang/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS