SECURITYCRITICALCVE-2026-19632

Critical TranslatePress Flaw Exposes 400,000+ WordPress Sites to Account Takeover

CVE-2026-19632 leaks a plaintext admin password-reset key via an unauthenticated AJAX action in TranslatePress, enabling full site takeover.

Dylan H.

Security Team

August 26, 2026
5 min read
Critical TranslatePress Flaw Exposes 400,000+ WordPress Sites to Account Takeover

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • TranslatePress – Translate Multilingual Sites with AI Translation Plugin ≤ 3.3.1

Executive Summary

A critical sensitive information exposure vulnerability (CVE-2026-19632) has been disclosed in TranslatePress – Translate Multilingual Sites with AI Translation, a WordPress plugin with over 400,000 active installations. The flaw carries a CVSS score of 9.8 and lets unauthenticated attackers extract an administrator's plaintext password-reset key directly from the plugin's translation dictionary table.

CVSS Score: 9.8 (Critical)

The bug lives in the plugin's trp_get_translations_regular AJAX action. TranslatePress hooks into WordPress's wp_mail() function to translate outgoing emails — including password-reset messages — into an administrator's preferred language. When the targeted administrator's profile uses a published secondary-language locale, the reset email is routed through that translation workflow and the raw reset URL, including the plaintext key, ends up stored in a dictionary table that the vulnerable AJAX action exposes without any authentication check. A patch shipped in version 3.3.2.

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-19632
CVSS Score9.8 (Critical)
TypeSensitive Information Exposure → Account Takeover
Attack VectorNetwork (no authentication required)
Privileges RequiredNone
User InteractionNone
ConditionTarget admin profile must use a published secondary-language locale

Affected Versions

PluginAffected VersionsFixed Version
TranslatePress – Translate Multilingual Sites with AI Translationup to and including 3.3.13.3.2

Attack Vector

1. Attacker identifies a WordPress site running a vulnerable TranslatePress version
2. Administrator triggers (or attacker triggers, via "forgot password") a reset email
3. TranslatePress's email-translation hook stores the raw reset URL, including
   the plaintext reset key, in its translation dictionary table
4. Attacker calls the unauthenticated trp_get_translations_regular AJAX action
   to read the dictionary and extract the reset key
5. Attacker uses the recovered key to reset the administrator's password
6. Attacker logs in with full administrative privileges

Impact of Successful Exploitation

ImpactDescription
Administrator Account TakeoverReset and hijack the admin password without credentials
Full Site CompromiseInstall plugins/themes, edit files, manage users
Data ExfiltrationAccess all site content, user data, and stored secrets
Malware DistributionServe malware or redirects to site visitors
PersistenceCreate additional rogue administrator accounts

Immediate Remediation

Step 1: Update to Version 3.3.2

# Via WP-CLI
wp plugin update translatepress-multilingual
 
# Verify the installed version
wp plugin get translatepress-multilingual --field=version

Or update through WordPress admin: Plugins > Installed Plugins > TranslatePress > Update Now.

Step 2: Audit Administrator Accounts

  1. Review Users > All Users for any unrecognized administrator accounts
  2. Confirm which admin profiles use a secondary-language locale
  3. Force a password reset for any administrator whose account may have been exposed before patching

Step 3: Enable Layered Defenses

  1. Enable two-factor authentication on all administrator accounts — this prevents login even if a reset link was stolen
  2. Review recent password-reset request logs for unusual timing or volume
  3. Rotate WordPress security keys and salts as a precaution:
wp config shuffle-salts

If Immediate Patching Is Not Possible

  1. Deactivate the TranslatePress plugin until the update can be applied
  2. Block access to wp-admin/admin-ajax.php requests carrying the trp_get_translations_regular action at the WAF level
  3. Monitor access logs for repeated unauthenticated AJAX calls to the plugin's endpoints

Detection Indicators

IndicatorDescription
Unauthenticated POST requests to admin-ajax.php with action=trp_get_translations_regularLikely exploitation attempt
Unexpected administrator password-reset eventsPossible successful key theft
New administrator accounts not created by known staffPost-exploitation persistence
Login events immediately following a reset request the admin didn't initiateAccount takeover in progress

Post-Remediation Steps

  1. Confirm plugin updated to 3.3.2 or later
  2. Force-reset passwords for all administrator accounts
  3. Enable two-factor authentication for every privileged account
  4. Review user accounts for unauthorized administrators created during the exposure window
  5. Rotate all credentials — WordPress admin, database, API keys
  6. Regenerate WordPress security keys using wp config shuffle-salts
  7. Deploy a WAF (Wordfence, Sucuri) for ongoing protection

Disclosure Timeline

  • August 11, 2026 — Researcher momopon1415 reports the flaw via the Wordfence Bug Bounty Program
  • August 12, 2026 — Cozmoslabs (plugin developer) acknowledges the report within 24 hours
  • August 13, 2026 — Version 3.3.2 ships with a fix
  • August 26, 2026 — CVE-2026-19632 published to the NVD

References

Related Reading