CVE-2026-97278: WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability
Published Oct 14, 2026
·Updated
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
Affected Software
1 affected component
WP SYNTEX Polylang<=3.8.9
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP SYNTEX Polylangto a version that resolves this vulnerability.Fixed in 3.8.10
Event History
Oct 14, 2026
CVE Published
via MITRE·12:08 PM
Data Sourced
via MITRE·12:08 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs high privileges. Exploitation does not require user interaction and can be performed over the network.
2
What impact could successful exploitation have?
The CVSS vector rates confidentiality, integrity, and availability impacts as high. Successful exploitation could therefore affect data exposure, modification, and service availability.
3
Which Polylang versions are affected?
Polylang versions through 3.8.9 are affected. The available data does not identify a fixed version.