CVE-2026-65458 MEDIUM

CVE-2026-65458: WordPress Polylang plugin <= 3.8.5 - Sensitive Data Exposure vulnerability

Vendor Chouby
Product Polylang
Weakness CWE-497
Published July 23, 2026
Last update July 23, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Contributor Sensitive Data Exposure in Polylang <= 3.8.5 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Polylang versions up to 3.8.5 expose sensitive information to authenticated users with low privileges. An attacker with a standard user account can read data they should not have access to. The vulnerability requires network access and an active login but does not require user interaction beyond authentication.

What an attacker can do

03Attacker Capabilities

Read sensitive data accessible only to higher-privilege users.

Potential impact on your site

04Site Impact

User account data and settings may be exposed to standard users who should not see them.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site.

Key dates

06Disclosure timeline

July 23, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2026-42644 WordPress BetterDocs plugin <= 4.3.10 - Sensitive Data Exposure vulnerability CVE-2025-31051 WordPress Plant - Gardening & Houseplants WordPress Theme <= 1.0.0 - Sensitive Data Exposure Vulnerability CVE-2026-24593 WordPress AWP Classifieds plugin <= 4.4.3 - Sensitive Data Exposure vulnerability CVE-2026-39686 WordPress BSK PDF Manager plugin <= 3.7.2 - Sensitive Data Exposure vulnerability CVE-2026-39536 WordPress RSVP and Event Management plugin <= 2.7.16 - Sensitive Data Exposure vulnerability