A significant security flaw in the TranslatePress plugin for WordPress has surfaced, potentially allowing unauthorized individuals to seize control of administrator accounts and fully compromise impacted websites.
Understanding the TranslatePress Vulnerability
The vulnerability, identified as CVE-2026-19632, affects TranslatePress versions up to 3.3.1. It has been addressed in version 3.3.2. TranslatePress, known for enabling multilingual capabilities on WordPress sites, boasts over 400,000 active users.
Wordfence, a prominent security firm, assigned this issue a CVSS score of 9.8, categorizing it as critical. The flaw was responsibly disclosed by security researcher momopon1415 through the Wordfence Bug Bounty Program, earning a reward of $975.
Technical Details of the Flaw
The root of the problem lies in how TranslatePress manages password reset emails and translatable strings. By intercepting the wp_mail() function, the plugin translates outgoing WordPress emails.
When an administrator initiates a password reset, WordPress creates an email with a URL containing a plaintext reset key. Under certain conditions, TranslatePress saves this URL in a translation dictionary table if automatic string saving is enabled, which is the default.
For exploitation, the administrator’s profile must use a secondary language. Attackers can then retrieve the URL using the plugin’s AJAX action, trp_get_translations_regular, which returns translation records based on supplied identifiers.
Implications and Recommendations
If attackers access the reset URL, they can reset the password and gain full administrative access, potentially leading to severe damage such as unauthorized account creation, malicious plugin installation, and data theft.
Wordfence stresses the vulnerability’s risk to businesses, publishers, and organizations relying on TranslatePress. However, the threat is specific to secondary-language profile locales, sparing default language users from this flaw.
After receiving a report on August 11, 2026, Wordfence quickly informed TranslatePress developer Cozmoslabs. A fix was released on August 13, urging site owners to update to version 3.3.2 immediately.
Taking Preventive Measures
Website administrators are advised to update TranslatePress without delay. Additionally, implementing two-factor authentication, limiting admin accounts, and regularly reviewing user activity and plugins are recommended to bolster security.
For enhanced protection, site owners should consider integrating threat intelligence services to prevent similar incidents proactively.
