# WP Multilang – Translation and Multilingual Plugin <= 2.4.34 - Authenticated (Subscriber+) Missing Authorization to Frontend Post Submission Manager Form Modification

- **ID:** WPSEC-2026-2737
- **Plugin:** WP Multilang – Translation and Multilingual Plugin (`wp-multilang`), https://wordpress.org/plugins/wp-multilang/
- **Affected versions:** from 2.4.33 before 2.4.35
- **Fixed in:** 2.4.35 (Update to 2.4.35 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-11-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-multilang
- **Fix released:** 2026-11-07
- **Published:** 2026-11-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2737/

## Description

The WP Multilang – Translation and Multilingual Plugin for WordPress is vulnerable to unauthorized modification of data via the Frontend Post Submission Manager integration in all versions up to, and including, 2.4.34, due to a missing capability check and missing nonce verification on the intercept_admin_form_save function. This function hooks the fpsml_form_edit_action AJAX action ahead of the Frontend Post Submission Manager's own handler, and for non-default languages it saves the submitted data itself and stops the request. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the translated titles and text settings of Frontend Post Submission Manager forms and change the forms' alias and status. Exploitation requires the Frontend Post Submission Manager Lite plugin to be active.

## References

- https://wpsec.com/vuln/WPSEC-2026-2737/
- https://plugins.svn.wordpress.org/wp-multilang/tags/2.4.35/
- https://wordpress.org/plugins/wp-multilang/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2737/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.