PT-2026-8067

CVE-2026-0745

Published

2026-02-13

Updated

2026-02-14

Description by

CVSS 3.1

5.5

Medium

MetricsAV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions User Language Switch plugin for WordPress versions prior to 1.6.11

Description The User Language Switch plugin for WordPress is susceptible to Server-Side Request Forgery due to insufficient URL validation within the download language() function. This allows authenticated attackers with Administrator-level access or higher to initiate web requests to arbitrary locations from the web application. This could potentially allow querying and modification of information from internal services.

Recommendations Update the User Language Switch plugin to version 1.6.11 or later.

Exploitability

Fix

Impacts

Researchers

Bhumividh Treloges

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers

CVE-2026-0745