Polylang <= 3.9.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Private Post Metadata Exposure via 'from_post' Parameter
- ID
- WPSEC-2026-2781
- Plugin
- Polylang (polylang)
- Affected
- all versions before 3.9.2
- Remediation
- Update to 3.9.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-11-10
- Attack surface
- Polylang on WPSec AttackSurface
- Fix released
- Published
Description
The Polylang plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'from_post' parameter used when creating a new post translation in all versions up to, and including, 3.9.1, due to the source post being loaded without checking that the user can read it, that its post type matches the post being created, or that the user can translate into the target language. The WPML compatibility API also read the 'from_post' value straight from the request. This makes it possible for authenticated attackers, with contributor-level access and above, to copy the public custom fields (post metadata) and taxonomy terms of private or draft posts owned by other users into a new post they own, and so read that metadata.
References
- https://wpsec.com/vuln/WPSEC-2026-2781/
- https://plugins.svn.wordpress.org/polylang/tags/3.9.2/
- https://wordpress.org/plugins/polylang/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS