# Polylang <= 3.9.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Private Post Metadata Exposure via 'from_post' Parameter

- **ID:** WPSEC-2026-2781
- **Plugin:** Polylang (`polylang`), https://wordpress.org/plugins/polylang/
- **Affected versions:** all versions before 3.9.2
- **Fixed in:** 3.9.2 (Update to 3.9.2 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/polylang
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2781/

## Description

The Polylang plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'from_post' parameter used when creating a new post translation in all versions up to, and including, 3.9.1, due to the source post being loaded without checking that the user can read it, that its post type matches the post being created, or that the user can translate into the target language. The WPML compatibility API also read the 'from_post' value straight from the request. This makes it possible for authenticated attackers, with contributor-level access and above, to copy the public custom fields (post metadata) and taxonomy terms of private or draft posts owned by other users into a new post they own, and so read that metadata.

## References

- https://wpsec.com/vuln/WPSEC-2026-2781/
- https://plugins.svn.wordpress.org/polylang/tags/3.9.2/
- https://wordpress.org/plugins/polylang/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2781/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.