Executive Summary
A critical sensitive information exposure vulnerability (CVE-2026-19632) has been disclosed in TranslatePress – Translate Multilingual Sites with AI Translation, a WordPress plugin with over 400,000 active installations. The flaw carries a CVSS score of 9.8 and lets unauthenticated attackers extract an administrator's plaintext password-reset key directly from the plugin's translation dictionary table.
CVSS Score: 9.8 (Critical)
The bug lives in the plugin's trp_get_translations_regular AJAX action. TranslatePress hooks into WordPress's wp_mail() function to translate outgoing emails — including password-reset messages — into an administrator's preferred language. When the targeted administrator's profile uses a published secondary-language locale, the reset email is routed through that translation workflow and the raw reset URL, including the plaintext key, ends up stored in a dictionary table that the vulnerable AJAX action exposes without any authentication check. A patch shipped in version 3.3.2.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-19632 |
| CVSS Score | 9.8 (Critical) |
| Type | Sensitive Information Exposure → Account Takeover |
| Attack Vector | Network (no authentication required) |
| Privileges Required | None |
| User Interaction | None |
| Condition | Target admin profile must use a published secondary-language locale |
Affected Versions
| Plugin | Affected Versions | Fixed Version |
|---|---|---|
| TranslatePress – Translate Multilingual Sites with AI Translation | up to and including 3.3.1 | 3.3.2 |
Attack Vector
1. Attacker identifies a WordPress site running a vulnerable TranslatePress version
2. Administrator triggers (or attacker triggers, via "forgot password") a reset email
3. TranslatePress's email-translation hook stores the raw reset URL, including
the plaintext reset key, in its translation dictionary table
4. Attacker calls the unauthenticated trp_get_translations_regular AJAX action
to read the dictionary and extract the reset key
5. Attacker uses the recovered key to reset the administrator's password
6. Attacker logs in with full administrative privilegesImpact of Successful Exploitation
| Impact | Description |
|---|---|
| Administrator Account Takeover | Reset and hijack the admin password without credentials |
| Full Site Compromise | Install plugins/themes, edit files, manage users |
| Data Exfiltration | Access all site content, user data, and stored secrets |
| Malware Distribution | Serve malware or redirects to site visitors |
| Persistence | Create additional rogue administrator accounts |
Immediate Remediation
Step 1: Update to Version 3.3.2
# Via WP-CLI
wp plugin update translatepress-multilingual
# Verify the installed version
wp plugin get translatepress-multilingual --field=versionOr update through WordPress admin: Plugins > Installed Plugins > TranslatePress > Update Now.
Step 2: Audit Administrator Accounts
- Review Users > All Users for any unrecognized administrator accounts
- Confirm which admin profiles use a secondary-language locale
- Force a password reset for any administrator whose account may have been exposed before patching
Step 3: Enable Layered Defenses
- Enable two-factor authentication on all administrator accounts — this prevents login even if a reset link was stolen
- Review recent password-reset request logs for unusual timing or volume
- Rotate WordPress security keys and salts as a precaution:
wp config shuffle-saltsIf Immediate Patching Is Not Possible
- Deactivate the TranslatePress plugin until the update can be applied
- Block access to
wp-admin/admin-ajax.phprequests carrying thetrp_get_translations_regularaction at the WAF level - Monitor access logs for repeated unauthenticated AJAX calls to the plugin's endpoints
Detection Indicators
| Indicator | Description |
|---|---|
Unauthenticated POST requests to admin-ajax.php with action=trp_get_translations_regular | Likely exploitation attempt |
| Unexpected administrator password-reset events | Possible successful key theft |
| New administrator accounts not created by known staff | Post-exploitation persistence |
| Login events immediately following a reset request the admin didn't initiate | Account takeover in progress |
Post-Remediation Steps
- Confirm plugin updated to 3.3.2 or later
- Force-reset passwords for all administrator accounts
- Enable two-factor authentication for every privileged account
- Review user accounts for unauthorized administrators created during the exposure window
- Rotate all credentials — WordPress admin, database, API keys
- Regenerate WordPress security keys using
wp config shuffle-salts - Deploy a WAF (Wordfence, Sucuri) for ongoing protection
Disclosure Timeline
- August 11, 2026 — Researcher momopon1415 reports the flaw via the Wordfence Bug Bounty Program
- August 12, 2026 — Cozmoslabs (plugin developer) acknowledges the report within 24 hours
- August 13, 2026 — Version 3.3.2 ships with a fix
- August 26, 2026 — CVE-2026-19632 published to the NVD
References
- NIST NVD — CVE-2026-19632
- CyberSecurityNews — WordPress Plugin Vulnerability Exposes 400,000 Sites to Account Takeover Attacks
- GBHackers — Critical WordPress TranslatePress Flaw Lets Attackers Take Over Admin Accounts