Critical TranslatePress WordPress Plugin Vulnerability Exposes Sites to Admin Account Takeover
A severe security flaw in the TranslatePress WordPress plugin (CVE-2026-19632) could allow unauthenticated attackers to hijack administrator accounts and fully compromise affected websites. The vulnerability, rated 9.8 (critical) on the CVSS scale, impacts all versions of TranslatePress up to 3.3.1, with a patch released in version 3.3.2.
The issue was discovered by security researcher momopon1415, who reported it through the Wordfence Bug Bounty Program and received a $975 reward. The flaw stems from how TranslatePress processes password reset emails and stores translatable strings. When an administrator requests a password reset, WordPress generates a reset URL containing a plaintext key. Under specific conditions including automatic string saving (enabled by default) and an administrator profile set to a published secondary language the plugin stores this sensitive URL in a translation dictionary table.
Attackers could exploit this by using the plugin’s publicly accessible trp_get_translations_regular AJAX action to retrieve stored translation entries, including the password reset link. With knowledge of an administrator’s username or email, an attacker could trigger a reset, extract the exposed URL, set a new password, and gain full administrative access.
Successful exploitation grants attackers control over the WordPress site, enabling them to create privileged accounts, install malicious plugins/themes, alter content, steal data, or distribute malware. The risk is particularly high for businesses, e-commerce stores, and publishers using TranslatePress.
The vulnerability was reported to Wordfence on August 11, 2026, disclosed to the plugin developer Cozmoslabs on August 12, and patched in version 3.3.2 on August 13. Notably, the flaw only affects sites where administrators use a published secondary language those with default language settings are not impacted.
Source: https://cybersecuritynews.com/translatepress-wordpress-plugin-vulnerability/
TranslatePress cybersecurity rating report: https://www.rankiteo.com/company/translatepress
"id": "TRA1787739836",
"linkid": "translatepress",
"type": "Vulnerability",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Businesses, e-commerce stores, '
'and publishers using '
'TranslatePress (versions up to '
'3.3.1) with administrators '
'using a published secondary '
'language',
'industry': 'Technology (WordPress Plugin Development)',
'name': 'Cozmoslabs (TranslatePress plugin)',
'type': 'Software Vendor'}],
'attack_vector': 'Remote',
'customer_advisories': 'Users of TranslatePress should update to version '
'3.3.2 immediately and review administrative accounts '
'for unauthorized access.',
'data_breach': {'personally_identifiable_information': 'Potential (if '
'accessed by '
'attackers)',
'sensitivity_of_data': 'High (administrative access, PII, '
'payment information if e-commerce)',
'type_of_data_compromised': 'Administrator credentials, site '
'content, customer data (if '
'applicable)'},
'date_detected': '2026-08-11',
'date_resolved': '2026-08-13',
'description': 'A severe security flaw in the TranslatePress WordPress plugin '
'(CVE-2026-19632) could allow unauthenticated attackers to '
'hijack administrator accounts and fully compromise affected '
'websites. The vulnerability stems from how TranslatePress '
'processes password reset emails and stores translatable '
'strings, exposing sensitive reset URLs in translation '
'dictionaries.',
'impact': {'brand_reputation_impact': 'High (potential for malware '
'distribution, data breaches, or '
'defacement)',
'data_compromised': 'Administrator account credentials, site '
'content, customer data (if applicable)',
'identity_theft_risk': 'High (if personally identifiable '
'information is accessed)',
'operational_impact': 'Full administrative access to WordPress '
'sites, potential malware distribution, data '
'theft, or content alteration',
'payment_information_risk': 'High (if e-commerce sites are '
'affected)',
'systems_affected': 'WordPress sites using TranslatePress plugin '
'(versions up to 3.3.1)'},
'investigation_status': 'Resolved',
'lessons_learned': 'Importance of secure handling of sensitive data (e.g., '
'password reset URLs) in translation plugins, need for '
'default security configurations, and timely patching of '
'critical vulnerabilities.',
'post_incident_analysis': {'corrective_actions': 'Patch released to fix the '
'vulnerability, removal of '
'sensitive data from '
'translation dictionaries, '
'and improved security '
'practices for handling '
'reset URLs.',
'root_causes': 'Insecure storage of password reset '
'URLs in translation dictionaries, '
'publicly accessible AJAX action '
'for retrieving translations, and '
'default configuration allowing '
'automatic string saving.'},
'recommendations': 'Update TranslatePress to version 3.3.2 or later, disable '
'automatic string saving if not needed, avoid publishing '
'secondary language profiles for administrators, and '
'monitor for unauthorized administrative access.',
'references': [{'source': 'Wordfence Bug Bounty Program'}],
'response': {'containment_measures': 'Patch released (version 3.3.2)',
'remediation_measures': 'Update to TranslatePress version 3.3.2 '
'or later',
'third_party_assistance': 'Wordfence Bug Bounty Program'},
'title': 'Critical TranslatePress WordPress Plugin Vulnerability Exposes '
'Sites to Admin Account Takeover',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'CVE-2026-19632'}