PT-2026-8067 · WordPress · Language Switcher

Bhumividh Treloges · Publicado 2026-02-14 · Atualizado 2026-02-14 · CVE-2026-0745

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions User Language Switch plugin for WordPress versions prior to 1.6.11

Description The User Language Switch plugin for WordPress is susceptible to Server-Side Request Forgery due to insufficient URL validation within the download language() function. This allows authenticated attackers with Administrator-level access or higher to initiate web requests to arbitrary locations from the web application. This could potentially allow querying and modification of information from internal services.

Recommendations Update the User Language Switch plugin to version 1.6.11 or later.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-0745

Produtos afetados

Language Switcher

Referências · 8

• https://wordfence.com/threat-intel/vulnerabilities/id/4d8d15be-6a7b-485e-a338-ccf1a6eb226c?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-0745 · Nota de Segurança
• https://downloads.wordpress.org/plugin/user-language-switch.zip · Nota
• https://plugins.trac.wordpress.org/browser/user-language-switch/tags/1.6.10/uls-options.php#L451 · Nota
• https://twitter.com/VulmonFeeds/status/2022694015758389504 · Publicação no Twitter
• https://wordpress.org/plugins/user-language-switch · Nota
• https://plugins.trac.wordpress.org/browser/user-language-switch/trunk/uls-options.php#L451 · Nota
• https://twitter.com/CVEnew/status/2022567906782134280 · Publicação no Twitter