CVE-2026-22462: CSRF in Add Polylang support for Customizer

A successful CSRF attack could allow an attacker to modify plugin settings, create or delete language configurations, or perform other actions as the logged-in user. The impact is amplified if the targeted user has administrative privileges, potentially granting the attacker control over the entire WordPress site. This vulnerability is similar to other CSRF flaws where user interaction is required, but the potential for unauthorized modifications makes it a significant security risk. The blast radius extends to any user with access to the plugin’s functionality.

1. Reserved2026-01-07
2. Published2026-01-22
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation is to upgrade the Add Polylang support for Customizer plugin to a version that addresses this vulnerability. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to filter out suspicious requests. Specifically, look for requests with unexpected origins or referrers. Additionally, ensure users are educated about the risks of clicking on untrusted links. After upgrading, confirm the fix by attempting to trigger a CSRF attack and verifying that the action is blocked or requires authentication.

Active installs

2KNiche

Plugin rating