CVE-2026-22462: 
WordPress vulnerability analysis and mitigation

CVE-2026-22462 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin "Add Polylang support for Customizer" (slug: add-polylang-support-for-customizer) developed by richardevcom. It affects all versions up to and including 1.4.5, with no official patch available at the time of disclosure. The vulnerability was reported by Nabil Irawan on December 5, 2025, and published on January 22, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to properly validate the origin of state-changing HTTP requests. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user (such as an administrator), silently triggers unauthorized actions within the plugin on behalf of that user. Exploitation requires no special privileges from the attacker but does require user interaction — specifically, a privileged user must be tricked into visiting a crafted page or clicking a malicious link (Patchstack).

Successful exploitation allows a malicious actor to force higher-privileged WordPress users (e.g., administrators) to execute unwanted actions within the plugin under their current authentication context, resulting in unauthorized integrity modifications to site configuration or plugin settings. Confidentiality and availability are not directly impacted, as the CVSS score reflects only a low integrity impact with no confidentiality or availability consequences. The scope is limited to the affected WordPress installation (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is extremely low at 0.000080 (approximately 0.008%), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite CSRF vulnerabilities of this type sometimes being used in mass-exploit campaigns against WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites running the "Add Polylang support for Customizer" plugin at version 1.4.5 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious request: Identify a state-changing action exposed by the plugin (e.g., a settings update form) that lacks CSRF token validation.
3. Build CSRF payload: Create an HTML page containing a hidden form or auto-submitting JavaScript that sends a forged POST/GET request to the target WordPress site's plugin endpoint, mimicking a legitimate action.
4. Deliver to victim: Trick an authenticated WordPress administrator into visiting the malicious page (e.g., via phishing email or malicious link).
5. Action executes: The victim's browser automatically submits the forged request with their valid session cookies, causing the plugin to perform the unauthorized action on their behalf (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to plugin-related admin endpoints (e.g., /wp-admin/admin-post.php or /wp-admin/options.php) from unusual referrer origins or with no referrer header.
• Logs: WordPress audit logs (if enabled) recording plugin configuration changes made by an administrator account at unusual times or without corresponding user activity.
• Network: HTTP requests to WordPress admin endpoints originating from external or unexpected referrer domains, particularly those lacking a valid nonce parameter in the request body.

No official patch has been released for this vulnerability as of the disclosure date; the plugin remains vulnerable at version 1.4.5 and below. Site administrators are advised to deactivate and remove the plugin until a patched version is available. As a compensating control, web application firewalls (WAFs) with CSRF protection rules (such as those provided by Patchstack) can help block exploitation attempts. Users should also ensure that privileged WordPress accounts follow safe browsing practices to reduce the risk of social engineering attacks (Patchstack).