The Falang multilanguage plugin for WordPress contains a deserialization flaw that allows untrusted data to be processed without validation. This leads to object injection, giving an attacker the ability to create arbitrary PHP objects. The presence of an object injection vulnerability can enable remote code execution or other malicious actions that compromise confidentiality, integrity, or availability, depending on the attacker’s capabilities. The weakness is identified as a CWE‑502: Deserialization of untrusted data.

All installations of the sbouey Falang multilanguage plugin from the initial release through version 1.3.65 are affected. Users running WordPress sites that have this plugin enabled and have not updated to a later version are at risk.

The flaw carries a high CVSS score of 8.8, indicating significant impact if successfully exploited. Its EPSS score of less than 1% suggests that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, with an attacker able to craft malicious payloads that the plugin processes during normal operation; the exact conditions are not explicitly described in the advisories, but the inference is that any user input processed by Falang could be manipulated.