CVE-2026-54805: WordPress Falang multilanguage plugin <= 1.4.2 - Privilege Escalation vulnerability

Synopsis

This is a privilege escalation vulnerability in the Falang multilanguage plugin for WordPress, affecting versions 1.4.2 and earlier. It is exploitable over the network by any authenticated user with a low-privilege account such as a subscriber, and requires no interaction from another user or administrator. Successful exploitation allows an attacker to elevate their privileges within the WordPress site, gaining unauthorized access to administrative functions and data. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WordPress site over the network; the vulnerable plugin endpoint is exposed via the standard HTTP interface.

• AuthenticationRequired

  A low-privilege account such as a subscriber role is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attacker does not need to trick or involve any other user; exploitation is performed entirely by the attacker alone.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• Attacker escalates from a subscriber-level account to higher-privilege roles, gaining access to WordPress administrative functions.
• Elevated access allows reading of all site content, user data, and configuration settings including stored credentials or API keys managed through the WordPress backend.
• With elevated privileges, the attacker can modify site content, install or alter plugins and themes, and change user account settings including administrator passwords.
• Full compromise of confidentiality, integrity, and availability of the WordPress instance and any data it stores or processes is achievable after escalation.