Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
User Language Switch plugin for WordPress allows attackers to access internal data
CVE-2026-0745
Summary
The User Language Switch plugin for WordPress is used by many sites. If not updated, an attacker with high-level access can use this plugin to access sensitive internal data. To protect your site, update the plugin to version 1.6.11 or later.
Original title
The User Language Switch plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.10 due to missing URL validation on the 'download_language()' fu...
Original description
The User Language Switch plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.10 due to missing URL validation on the 'download_language()' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
nvd CVSS3.1
7.2
Vulnerability type
CWE-918
Server-Side Request Forgery (SSRF)
- https://downloads.wordpress.org/plugin/user-language-switch.zip
- https://plugins.trac.wordpress.org/browser/user-language-switch/tags/1.6.10/uls-...
- https://plugins.trac.wordpress.org/browser/user-language-switch/trunk/uls-option...
- https://wordpress.org/plugins/user-language-switch/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4d8d15be-6a7b-485e-a33...
Published: 14 Feb 2026 · Updated: 10 Mar 2026 · First seen: 6 Mar 2026