# WP Multilang – Translation and Multilingual Plugin <= 2.4.34 - Unauthenticated Missing Authorization to Autolink and Category Translation Modification

- **ID:** WPSEC-2026-2738
- **Plugin:** WP Multilang – Translation and Multilingual Plugin (`wp-multilang`), https://wordpress.org/plugins/wp-multilang/
- **Affected versions:** from 2.4.32 before 2.4.35
- **Fixed in:** 2.4.35 (Update to 2.4.35 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-11-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-multilang
- **Fix released:** 2026-11-07
- **Published:** 2026-11-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2738/

## Description

The WP Multilang – Translation and Multilingual Plugin for WordPress is vulnerable to unauthorized modification of data via the Autolinks Manager integration in all versions up to, and including, 2.4.34, due to a missing capability check and missing nonce verification on the intercept_form_submissions function. This function is hooked to admin_init, which also runs for unauthenticated requests to admin-post.php and admin-ajax.php. This makes it possible for unauthenticated attackers to overwrite the non-default-language name, keyword, title and URL of existing autolinks, and the name and description of autolink categories. Those values are then used when autolinks are added to post content on the front end. Exploitation requires the Autolinks Manager plugin to be active.

## References

- https://wpsec.com/vuln/WPSEC-2026-2738/
- https://plugins.svn.wordpress.org/wp-multilang/tags/2.4.35/
- https://wordpress.org/plugins/wp-multilang/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2738/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.