The Falang multilanguage for WordPress plugin suffers from a missing capability check in several functions, enabling authenticated users with low privileges (Subscriber-level and above) to update and delete translations and access the administrator email address. This vulnerability is classified under CWE-862 (Missing Authorization). It affects all versions up to and including 1.3.52. The CVSS 3.1 base score is 5.4, reflecting a network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

An attacker with Subscriber-level access or higher can modify translation content and expose the administrator's email address, potentially leading to information disclosure and unauthorized data modification within the WordPress site. There is no indication of availability impact or remote exploitation without authentication. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for unauthorized changes to translation data. Avoid granting Subscriber-level or higher access to untrusted users.