The Polylang plugin for WordPress contains a critical deserialization vulnerability that allows authenticated attackers to perform object injection, potentially leading to full system compromise.

The plugin fails to safely handle deserialization of untrusted data, which constitutes a CWE-502 flaw. This vulnerability can be triggered by an authenticated user with low privileges to achieve remote code execution, unauthorized data modification, or service disruption.

Successful exploitation of this vulnerability poses a severe risk to the integrity, confidentiality, and availability of the affected WordPress site. With a CVSS score of 8.8, this flaw is categorized as High severity, reflecting the potential for an attacker to achieve total system impact. Organizations failing to remediate this issue face significant threats, including full administrative site takeover and potential secondary attacks against the underlying host server.

Immediate Action: Update the Polylang plugin to the latest available version beyond 3.7.3 as soon as the vendor releases a security patch.

Proactive Monitoring: Monitor server access logs for suspicious serialized payloads in HTTP requests and review administrative logs for unauthorized plugin configuration changes.

Compensating Controls: If an update is not immediately available, deploy a Web Application Firewall (WAF) rule designed to detect and block malicious deserialization patterns targeting WordPress plugins.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant security risk for any WordPress environment utilizing the Polylang plugin. Because the flaw allows for object injection, it is imperative that administrators prioritize patching as soon as the vendor provides a fix. Until a patch is applied, ensure that access to the WordPress dashboard is strictly limited to trusted personnel and verify that the latest security updates are applied to all other plugins to maintain a robust defense-in-depth posture.