Server-Side Request Forgery Vulnerability in User Language Switch Plugin for WordPress

CVE-2026-0745

What is CVE-2026-0745?

The User Language Switch plugin for WordPress allows authenticated users with Administrator-level access or higher to exploit a vulnerability in the 'download_language()' function. Due to insufficient URL validation, attackers can perform Server-Side Request Forgery, enabling them to initiate web requests to unintended external sites or internal services. This could lead to unauthorized data exposure, internal service manipulation, or other security breaches, emphasizing the importance of immediate patching or updating to mitigate risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References