WordPress Plugin Vulnerabilities

Falang multilanguage for WordPress < 1.4.3 - Subscriber+ Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation, allowing authenticated attackers with Subscriber-level access and above to elevate their privileges.

Affects Plugins

Plugin icon
falang
Fixed in 1.4.3

References

CVE
CVE-2026-54805
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/bf11aed9-8782-4579-95a5-e88b19641ae8

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
8.8 (high)

Miscellaneous

Original Researcher
ParkHyunWoo
Verified
Yes
WPVDB ID
62910562-e69f-42bf-bbba-448b4eaafdac

Timeline

Publicly Published
2026-06-16 (about 4 months ago)
Added
2026-06-25 (about 3 months ago)
Last Updated
2026-10-16 (about 8 hours ago)

Other

Published
Title
Published
2026-06-03
Title
Dokan < 5.0.3 - Customer+ Privilege Escalation
Published
2026-09-17
Title
UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email
Published
2026-08-14
Title
Real Estate Manager Pro < 12.8.7 - Authenticated (Subscriber+) Privilege Escalation via 'user_has_cap' Filter ID Collision
Published
2026-10-09
Title
Groundhogg < 4.9 - Unauthenticated Privilege Escalation to Support User Identity Confusion
Published
2024-09-30
Title
Echo RSS Feed Post Generator < 5.4.7 - Unauthenticated Privilege Escalation