Critical WordPress Plugin Vulnerability Exposes 400,000 Sites

Key Takeaways

• A critical vulnerability (CVE-2026-19632) has been discovered in the TranslatePress WordPress plugin.
• The flaw could enable unauthenticated attackers to seize administrator accounts on approximately 400,000 WordPress sites.
• The vulnerability, rated 9.8 CVSS, allows for full site compromise.
• A patch is available in TranslatePress version 3.3.2 and later.

Critical Flaw in TranslatePress Threatens 400,000 WordPress Sites

A severe security vulnerability in the widely used TranslatePress WordPress plugin could allow unauthorized individuals to gain complete control over an estimated 400,000 websites. The flaw, identified as CVE-2026-19632, enables unauthenticated attackers to hijack administrator accounts by exploiting a weakness in how the plugin handles password reset emails.

The issue affects TranslatePress versions up to 3.3.1 and has since been addressed in version 3.3.2. TranslatePress is a popular multilingual plugin, with over 400,000 active installations globally, making the potential impact of this vulnerability substantial.

Vulnerability Details and Exploitation

Security firm Wordfence, which assigned the vulnerability a critical CVSS score of 9.8, confirmed the details. The flaw was responsibly disclosed by security researcher momopon1415 through the Wordfence Bug Bounty Program, earning a $975 reward for their discovery.

The core of the vulnerability lies in TranslatePress’s mechanism for processing and translating outgoing WordPress emails, specifically its interception of the wp_mail() function. When a WordPress administrator initiates a password reset, the system generates an email containing a reset URL, which includes a plaintext reset key and login parameters.

Under specific conditions, TranslatePress inadvertently stores this sensitive password reset URL within its secondary-language translation dictionary table. This exposure occurs if the plugin’s automatic string saving feature is enabled (which is the default setting), and if the targeted administrator’s profile is configured to use a published secondary language rather than the site’s default language.

Researchers discovered that attackers can retrieve these stored dictionary entries through the plugin’s publicly accessible trp_get_translations_regular AJAX action. This endpoint accepts attacker-supplied string identifiers and returns corresponding translation records. An unauthenticated attacker can leverage this to enumerate translation data and locate a stored password reset URL.

An attacker with knowledge of an administrator’s username or email address could trigger a password reset request. By then extracting the exposed reset link from the translation dictionary, they could set a new password and log in as the administrator. Such a successful exploitation would grant the attacker full administrative control over the compromised WordPress site.

With administrator privileges, threat actors could execute a range of malicious activities, including creating new privileged accounts, installing malicious plugins or backdoored themes, altering website content, exfiltrating sensitive information, or using the compromised site to distribute malware. This presents a significant risk to businesses, publishers, e-commerce platforms, and other organizations utilizing TranslatePress.

It is important to note that not all TranslatePress deployments are equally affected. The exposure of the password reset URL is contingent on the targeted administrator having their profile locale set to a published secondary language. Administrators whose accounts use the site’s default language are not subject to this specific vulnerability, as their password reset emails are not processed through the vulnerable secondary-language translation workflow.

Wordfence received the report on August 11, 2026, and promptly disclosed the issue to TranslatePress developer Cozmoslabs on August 12. The vendor released TranslatePress version 3.3.2 on August 13, addressing the vulnerability.

What You Should Do

• Update Immediately: Site owners must update TranslatePress to version 3.3.2 or later without delay.
• Enable Two-Factor Authentication: Implement two-factor authentication (2FA) or passkeys for all administrator accounts to add an extra layer of security.
• Limit Administrator Accounts: Review and minimize the number of accounts with administrator privileges.
• Review User Activity: Regularly monitor user activity logs for any suspicious or unauthorized actions.
• Inspect Plugins and Themes: Periodically inspect installed plugins and themes for any unauthorized changes or newly introduced backdoors.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.