CVE-2026-0745: WordPress User Language Switch SSRF Flaw

CVE-2026-0745 Overview

The User Language Switch plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 1.6.10. The flaw exists due to missing URL validation in the download_language() function, allowing authenticated attackers with Administrator-level access to make arbitrary web requests originating from the web application. This vulnerability can be leveraged to query and modify information from internal services that would otherwise be inaccessible from external networks.

Critical Impact

Authenticated administrators can exploit this SSRF vulnerability to access internal network resources, potentially exposing sensitive internal services, cloud metadata endpoints, and enabling further lateral movement within the network infrastructure.

Affected Products

• User Language Switch plugin for WordPress versions up to and including 1.6.10

Discovery Timeline

• 2026-02-14 - CVE-2026-0745 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-0745

Vulnerability Analysis

This Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exists within the User Language Switch plugin's language download functionality. The download_language() function fails to properly validate user-supplied URLs before making server-side HTTP requests. When an authenticated administrator provides a malicious URL through the plugin's interface, the WordPress server processes the request without verifying whether the target is an internal or external resource.

The network-based attack vector allows exploitation from remote locations, and the vulnerability can affect resources beyond the vulnerable component's scope. Successful exploitation enables attackers to read data from internal services and potentially modify internal system configurations, though it does not directly impact system availability.

Root Cause

The root cause of this vulnerability is the absence of URL validation and sanitization in the download_language() function located in uls-options.php at line 451. The plugin accepts arbitrary URLs for downloading language files without implementing allowlist checks, URL scheme restrictions, or internal network address filtering. This oversight permits the server to make requests to any network location specified by the attacker.

Attack Vector

The attack requires an authenticated session with Administrator-level privileges on the WordPress installation. Once authenticated, an attacker can manipulate the URL parameter passed to the download_language() function to target internal network resources. Common exploitation scenarios include:

The attacker can target cloud metadata services (such as AWS EC2 metadata at http://169.254.169.254/), internal web applications, database management interfaces, or any service accessible from the WordPress server's network perspective. The server acts as a proxy, making requests on behalf of the attacker and returning responses that may contain sensitive internal data.

By chaining this vulnerability with other attack techniques, adversaries could potentially escalate access to cloud infrastructure credentials, internal API keys, or sensitive configuration data stored in backend services.

Detection Methods for CVE-2026-0745

Indicators of Compromise

• Unusual outbound HTTP requests from the WordPress server to internal IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints (169.254.169.254) originating from the web application
• Unexpected network connections from the web server to internal services on non-standard ports
• Access logs showing the download_language() function being called with suspicious URL parameters

Detection Strategies

• Monitor web application firewall (WAF) logs for SSRF patterns in request parameters targeting internal addresses
• Implement egress traffic monitoring to detect outbound connections to internal network ranges or known metadata endpoints
• Review WordPress admin activity logs for suspicious plugin configuration changes or language download attempts
• Deploy network segmentation monitoring to detect unauthorized cross-segment communication from web tier

Monitoring Recommendations

• Enable verbose logging for the User Language Switch plugin to capture all URL download attempts
• Configure alerting for any outbound requests from the web server to RFC1918 private address spaces
• Implement cloud security posture monitoring to detect metadata service access from web application instances
• Establish baseline network traffic patterns and alert on anomalous outbound connections

How to Mitigate CVE-2026-0745

Immediate Actions Required

• Update the User Language Switch plugin to a version newer than 1.6.10 when a patch becomes available
• Review administrator account access and implement principle of least privilege for WordPress admin roles
• Implement network-level controls to restrict the web server's ability to access internal services
• Consider temporarily disabling the User Language Switch plugin if the language download functionality is not critical

Patch Information

Organizations should monitor the WordPress Plugin Repository for updated versions that address this vulnerability. The vulnerable code is located in uls-options.php at line 451, as documented in the WordPress Plugin Source Code. Additional technical details are available in the Wordfence Vulnerability Report.

Workarounds

• Implement a Web Application Firewall (WAF) rule to block SSRF patterns in plugin parameters
• Configure network egress filtering to prevent the web server from connecting to internal IP ranges and cloud metadata services
• Restrict plugin functionality through WordPress hooks to disable the download_language() feature until patched
• Deploy instance metadata service (IMDS) v2 on cloud instances to require session tokens for metadata access

# Example: Block outbound requests to common SSRF targets using iptables
# Block requests to AWS metadata endpoint
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Block requests to internal networks from web server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP