CVE-2022-38461: Wpml

Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change plugin settings (selected language for legacy widgets, the default behavior for media content).

Affected products

• Wpml Wpml: up to and including 4.5.10

Published 2022-11-17. Last modified 2026-06-17.