A deserialization of untrusted data flaw in the WordPress Polylang plugin allows an attacker to supply crafted PHP objects that the plugin unserializes without proper validation. The effect of this object injection is the ability to trigger arbitrary code execution on the target WordPress site. The vulnerability applies to all Polylang releases up to 3.8.9.

WordPress sites that have installed the WP SYNTEX Polylang plugin, version 3.8.9 or earlier. The plugin is typically used to provide multilingual support across WordPress sites, making it a common target in environments that rely on multilinguistic content.

The CVSS score of 7.2 indicates a high severity level. The EPSS score of 0.00437 indicates a very low probability of exploitation. The issue is not listed in the CISA KEV catalog. Based on the description, the most probable attack vector involves an attacker sending a crafted HTTP request that contains a serialized object to the plugin, which then processes it. In doing so, the attacker can gain remote code execution over the WordPress installation. The lack of a public exploit does not lessen the potential impact, as the vulnerability can be exercised by anyone with network access to the site.