WP Multilang – Translation and Multilingual Plugin <= 2.4.34 - Authenticated (Subscriber+) Missing Authorization to Frontend Post Submission Manager Form Modification
- ID
- WPSEC-2026-2737
- Plugin
- WP Multilang – Translation and Multilingual Plugin (wp-multilang)
- Affected
- from 2.4.33 before 2.4.35
- Remediation
- Update to 2.4.35 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-11-08
- Attack surface
- WP Multilang – Translation and Multilingual Plugin on WPSec AttackSurface
- Fix released
- Published
Description
The WP Multilang – Translation and Multilingual Plugin for WordPress is vulnerable to unauthorized modification of data via the Frontend Post Submission Manager integration in all versions up to, and including, 2.4.34, due to a missing capability check and missing nonce verification on the intercept_admin_form_save function. This function hooks the fpsml_form_edit_action AJAX action ahead of the Frontend Post Submission Manager's own handler, and for non-default languages it saves the submitted data itself and stops the request. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the translated titles and text settings of Frontend Post Submission Manager forms and change the forms' alias and status. Exploitation requires the Frontend Post Submission Manager Lite plugin to be active.
References
- https://wpsec.com/vuln/WPSEC-2026-2737/
- https://plugins.svn.wordpress.org/wp-multilang/tags/2.4.35/
- https://wordpress.org/plugins/wp-multilang/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS