The vulnerability identified as CVE-2026-24585 affects the Hyyan WooCommerce Polylang Integration plugin (versions <= 1.5.0). It is caused by missing authorization checks, allowing users with low privileges to access functionality or data that should be restricted. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates that the attack can be performed remotely over the network with low attack complexity, requires low privileges, no user interaction, and results in high confidentiality impact without affecting integrity or availability.

An attacker with low privileges can exploit this vulnerability remotely to gain unauthorized access to sensitive information, resulting in a high confidentiality impact. There is no impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual access patterns. Avoid granting unnecessary privileges to users who can interact with the plugin.