Broken Access Control vulnerability leading to plugin settings change (selected language for legacy widgets can be changed, and default behavior for media content can be changed) discovered by Dave Jong in WordPress WPML Multilingual CMS premium plugin (versions <= 4.5.10).
Update the WordPress Multilingual CMS plugin to the latest available version (at least 4.5.11).