The vulnerability is a missing authorization flaw in the Polylang plugin, allowing attackers to modify settings that should be restricted. Identified as CWE-862, this flaw lets a user bypass defined security levels and alter the application state. The likely attack vector is through the plugin’s administrative interface or exposed configuration endpoints, enabling an attacker to gain unauthorized access to plugin configuration and potentially manipulate site content.

The Polylang plugin version 3.9 and all earlier releases distributed by WP Syntx for WordPress are affected. All sites running these versions are potentially vulnerable.

The CVSS score of 5.4 indicates moderate severity. No EPSS score is available, so the likelihood of exploitation remains uncertain. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploits yet. Based on the description, an attacker would likely need only to interact with the plugin’s management interface, so prerequisites are minimal.