The Add Polylang Support for Customizer plugin for WordPress is vulnerable to a token‑less cross‑site request forgery flaw (CWE‑352). An attacker who can trick a legitimate user into visiting a crafted URL may cause that user’s browser to send authenticated requests to the WordPress site, inadvertently altering settings, modifying content, or performing other privileged actions depending on the user’s permissions. The vulnerability allows unintended execution of user‑triggered actions, which can compromise configuration integrity and content authenticity.

All installations of the Add Polylang Support for Customizer plugin version 1.4.5 or earlier provided by the vendor richardevcom. The flaw resides in the plugin’s request handling, so every WordPress site that has the plugin active and in any core version is affected.

The CVSS score of 4.3 indicates moderate severity, while an EPSS score of less than 1% suggests exploitation likelihood is currently low. The flaw is not listed in the CISA KEV catalog, further implying limited known exploitation. The likely attack vector is a victim user with site administrator or editor privileges who is lured into clicking a malicious link; network‑only or remote code execution is not required. An attacker could embed the crafted link in emails, forums, or advertisements to conduct the attack. Given the low exploitation probability, the main risk is exposure to accidental or targeted CSRF attacks while awaiting a vendor patch.