Overview of the Issue
When using the permalink structure /%category%/%postname%/, translated posts are accessible through the category slug of the original language.
For example, this is expected:
http://www.domain.com/english-books/hello-world-en/
http://www.domain.com/es/spanish-books/hello-world-es/
However, you shouldn’t be able to access to:
http://www.domain.com/es/english-books/hello-world-es/
Workaround
This issue is fixed in WPML 4.9.3. Updating solves it on your site, so you only need this workaround if you can’t update yet.
We don’t have an available workaround, but our developers are already aware of this issue.