The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks in the process_polylang_theme_translation_wp_loaded() function. This makes it possible for unauthenticated attackers to update plugin and theme translation settings and to import translation strings.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Theme Translation For Polylang Plugin | — | Update theme-translation-for-polylang plugin to version 3.2.17, or a newer patched version | May 15, 2025 | Nov 28, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub