CVE-2026-0745: WordPress User Language Switch SSRF Flaw

CVE-2026-0745 Overview

The User Language Switch plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 1.6.10. The flaw exists due to missing URL validation in the download_language() function, allowing authenticated attackers with Administrator-level access to make arbitrary web requests originating from the web application. This vulnerability can be leveraged to query and modify information from internal services that would otherwise be inaccessible from external networks.

Critical Impact
Authenticated administrators can exploit this SSRF vulnerability to access internal network resources, potentially exposing sensitive internal services, cloud metadata endpoints, and enabling further lateral movement within the network infrastructure.

Affected Products

User Language Switch plugin for WordPress versions up to and including 1.6.10

Discovery Timeline

2026-02-14 - CVE-2026-0745 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-0745

Vulnerability Analysis

This Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exists within the User Language Switch plugin's language download functionality. The download_language() function fails to properly validate user-supplied URLs before making server-side HTTP requests. When an authenticated administrator provides a malicious URL through the plugin's interface, the WordPress server processes the request without verifying whether the target is an internal or external resource.

The network-based attack vector allows exploitation from remote locations, and the vulnerability can affect resources beyond the vulnerable component's scope. Successful exploitation enables attackers to read data from internal services and potentially modify internal system configurations, though it does not directly impact system availability.

Root Cause

The root cause of this vulnerability is the absence of URL validation and sanitization in the download_language() function located in uls-options.php at line 451. The plugin accepts arbitrary URLs for downloading language files without implementing allowlist checks, URL scheme restrictions, or internal network address filtering. This oversight permits the server to make requests to any network location specified by the attacker.

Attack Vector

The attack requires an authenticated session with Administrator-level privileges on the WordPress installation. Once authenticated, an attacker can manipulate the URL parameter passed to the download_language() function to target internal network resources. Common exploitation scenarios include:

The attacker can target cloud metadata services (such as AWS EC2 metadata at http://169.254.169.254/), internal web applications, database management interfaces, or any service accessible from the WordPress server's network perspective. The server acts as a proxy, making requests on behalf of the attacker and returning responses that may contain sensitive internal data.

By chaining this vulnerability with other attack techniques, adversaries could potentially escalate access to cloud infrastructure credentials, internal API keys, or sensitive configuration data stored in backend services.

Detection Methods for CVE-2026-0745

Indicators of Compromise

Unusual outbound HTTP requests from the WordPress server to internal IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
Requests to cloud metadata endpoints (169.254.169.254) originating from the web application
Unexpected network connections from the web server to internal services on non-standard ports
Access logs showing the download_language() function being called with suspicious URL parameters

Detection Strategies

Monitor web application firewall (WAF) logs for SSRF patterns in request parameters targeting internal addresses
Implement egress traffic monitoring to detect outbound connections to internal network ranges or known metadata endpoints
Review WordPress admin activity logs for suspicious plugin configuration changes or language download attempts
Deploy network segmentation monitoring to detect unauthorized cross-segment communication from web tier

Monitoring Recommendations

Enable verbose logging for the User Language Switch plugin to capture all URL download attempts
Configure alerting for any outbound requests from the web server to RFC1918 private address spaces
Implement cloud security posture monitoring to detect metadata service access from web application instances
Establish baseline network traffic patterns and alert on anomalous outbound connections

How to Mitigate CVE-2026-0745

Immediate Actions Required

Update the User Language Switch plugin to a version newer than 1.6.10 when a patch becomes available
Review administrator account access and implement principle of least privilege for WordPress admin roles
Implement network-level controls to restrict the web server's ability to access internal services
Consider temporarily disabling the User Language Switch plugin if the language download functionality is not critical

Patch Information

Organizations should monitor the WordPress Plugin Repository for updated versions that address this vulnerability. The vulnerable code is located in uls-options.php at line 451, as documented in the WordPress Plugin Source Code. Additional technical details are available in the Wordfence Vulnerability Report.

Workarounds

Implement a Web Application Firewall (WAF) rule to block SSRF patterns in plugin parameters
Configure network egress filtering to prevent the web server from connecting to internal IP ranges and cloud metadata services
Restrict plugin functionality through WordPress hooks to disable the download_language() feature until patched
Deploy instance metadata service (IMDS) v2 on cloud instances to require session tokens for metadata access

bash

# Example: Block outbound requests to common SSRF targets using iptables
# Block requests to AWS metadata endpoint
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Block requests to internal networks from web server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP