A Cross‑Site Request Forgery (CSRF) vulnerability exists in the Falang multilanguage WordPress plugin that can allow a malicious site to trick an authenticated user into performing unintended actions within the WordPress installation. The weakness, classified as CWE‑352, permits exploitation of state‑changing requests without the user’s explicit consent.

The Falang multilanguage plugin by sbouey is affected when its version is 1.3.61 or earlier. Users running any release in that range of the plugin are potentially vulnerable.

The CVSS base score of 4.3 indicates moderate severity. The EPSS score of less than 1 % suggests that exploitation is unlikely at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. The attack vector for a CSRF exploit would require a victim user to be logged into WordPress while visiting a malicious webpage that initiates a forged request to the plugin’s endpoints. Successful exploitation would allow the attacker to modify language settings or perform other plugin‑managed changes without the user’s knowledge.