Description
Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WP SYNTEX | Polylang | ≤ 3.8.9 | — |
High · 7.2
CVE-2026-97278
EUVD-2026-101009GHSA-qr9f-p3hp-mggj
WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability
Published Oct 14, 2026 · Updated Oct 14, 2026 · Assigned by Patchstack