A critical deserialization vulnerability in the sbouey Falang multilanguage plugin could allow an unauthenticated attacker to achieve remote code execution.

The plugin is susceptible to PHP object injection via the deserialization of untrusted data, which can be triggered by an unauthenticated attacker.

The exploitation of this vulnerability poses a significant risk to the integrity, confidentiality, and availability of the host WordPress environment. With a CVSS score of 8.8, this flaw is considered high severity and could lead to full system compromise, data exfiltration, or unauthorized administrative actions.

Immediate Action: As no official patch is currently confirmed, administrators should immediately deactivate and remove the Falang multilanguage plugin until a secure version is released by the vendor.

Proactive Monitoring: Monitor server logs for unusual HTTP requests containing serialized PHP objects or unexpected spikes in resource utilization.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common PHP object injection patterns and malicious deserialization attempts.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the potential for remote code execution, this vulnerability represents an urgent security risk. Organizations currently utilizing the Falang multilanguage plugin are advised to prioritize its removal from their production environments until the vendor provides a verified security update.