WP Multilang – Translation and Multilingual Plugin <= 2.4.34 - Unauthenticated Missing Authorization to Autolink and Category Translation Modification
- ID
- WPSEC-2026-2738
- Plugin
- WP Multilang – Translation and Multilingual Plugin (wp-multilang)
- Affected
- from 2.4.32 before 2.4.35
- Remediation
- Update to 2.4.35 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-11-08
- Attack surface
- WP Multilang – Translation and Multilingual Plugin on WPSec AttackSurface
- Fix released
- Published
Description
The WP Multilang – Translation and Multilingual Plugin for WordPress is vulnerable to unauthorized modification of data via the Autolinks Manager integration in all versions up to, and including, 2.4.34, due to a missing capability check and missing nonce verification on the intercept_form_submissions function. This function is hooked to admin_init, which also runs for unauthenticated requests to admin-post.php and admin-ajax.php. This makes it possible for unauthenticated attackers to overwrite the non-default-language name, keyword, title and URL of existing autolinks, and the name and description of autolink categories. Those values are then used when autolinks are added to post content on the front end. Exploitation requires the Autolinks Manager plugin to be active.
References
- https://wpsec.com/vuln/WPSEC-2026-2738/
- https://plugins.svn.wordpress.org/wp-multilang/tags/2.4.35/
- https://wordpress.org/plugins/wp-multilang/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS