CVE-2026-65458

Deferred Deferred - Pending Action

Contributor Sensitive Data Exposure in Polylang

Publication date: 2026-07-23

Last updated on: 2026-08-06

Assigner: Patchstack

Description

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Sensitive Data. This issue affects Polylang: through 3.8.5; Polylang Pro: through 3.8.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-08-06

Generated

2026-08-12

AI Q&A

2026-07-23

EPSS Evaluated

2026-08-11

NVD

CVE-2026-65458

EUVD

EUVD-2026-48223

Affected Vendors & Products

Vendor	Product	Version / Range
polylang	polylang	to 3.8.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-497	The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

Executive Summary

This vulnerability is a Sensitive Data Exposure issue in the WordPress Polylang plugin versions 3.8.5 and earlier. It allows unauthorized users to view sensitive information that should be restricted, potentially leading to further exploitation of system weaknesses.

Detection Guidance

Check the installed version of the Polylang plugin in your WordPress admin panel under Plugins. If it is version 3.8.5 or earlier, the system is vulnerable. Use commands like 'wp plugin list' in WP-CLI or inspect the plugin files in /wp-content/plugins/polylang/ to verify the version.

Impact Analysis

Malicious actors could access restricted data, which may include user information or other sensitive details. This could lead to privacy breaches, identity theft, or additional attacks on the system if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing personal or health-related data. Organizations may face legal penalties, fines, or reputational damage if sensitive data is compromised due to this issue.

Mitigation Strategies

Update the Polylang plugin to version 3.8.6 or later immediately. If updating is not possible, disable the plugin temporarily until an update is applied. Enable auto-updates for the plugin if available to prevent future vulnerabilities.

Hi! I’m here to help you understand CVE-2026-65458. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70