Missing Authorization Vulnerability in WP SYNTEX Polylang Plugin
CVE-2026-39783

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Polylang
Vendor
CVE Published:
5 October 2026

What is CVE-2026-39783?

The WP SYNTEX Polylang plugin is affected by a missing authorization vulnerability that enables the retrieval of embedded sensitive data without proper access control. Versions of Polylang from n/a to 3.8.7 are affected, potentially allowing unauthorized users to access private information. It's crucial for users to update to the latest version to mitigate this risk and secure their data.

Affected Version(s)

Polylang 0 <= 3.8.7

References

https://patchstack.com/database/wordpress/plugin/polylang...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal (Patchstack)
.