TranslatePress, a WordPress plugin with more than 400,000 active installations, has been found vulnerable to an unauthenticated account takeover flaw that can expose an administrator’s password reset link and lead to full site compromise. Wordfence says the issue affects versions up to 3.3.1 and has been patched in 3.3.2.
How the TranslatePress vulnerability works
According to Wordfence, the bug can be exploited without authentication by chaining two plugin behaviors. First, TranslatePress processes outgoing password reset emails through its translation pipeline when automatic string saving is enabled, which is the default setting.
If the target administrator’s profile language is set to a published secondary language, the full password reset URL — including the plaintext reset key and login parameters — can be stored in a translation dictionary table. A second issue then allows a public AJAX action, trp_get_translations_regular, to return dictionary rows when supplied with attacker-controlled string IDs.
That combination makes it possible for an attacker to retrieve the reset link in plaintext, reset the administrator’s password, and log in as that user. Wordfence assigned the issue a CVSS score of 9.8 and identified it as CVE-2026-19632.
Why this can lead to full site takeover
Once an attacker has administrator access, the consequences are the same as with many high-severity WordPress account takeover bugs: they can install malicious plugins or themes, create new admin accounts, alter site content, or steal sensitive data. In practice, that means the vulnerability can become a complete compromise of the affected site.
Wordfence says the flaw is only exploitable under a specific condition: the target administrator must have their profile locale set to a published secondary language. If an administrator uses the site’s default language, their password reset email is not persisted in the secondary-language dictionary table, and the public AJAX request cannot read it back.
TranslatePress vulnerability details and patch status
The vulnerable plugin is TranslatePress – Multilingual & AI Translation, also listed as translatepress-multilingual in WordPress.org. Wordfence’s summary says versions 3.3.1 and earlier are affected, while 3.3.2 is the patched release.
Wordfence says it received the submission on August 11, 2026, validated the report and disclosed it to the vendor on August 12, 2026, and saw the developer acknowledge the issue and release a fix on August 13, 2026. The company also said it sent a firewall rule to Wordfence Premium, Care and Response users on August 13, with free users scheduled to receive the same protection 30 days later, on September 12, 2026.
Researcher credited through Wordfence Bug Bounty
Wordfence credited the discovery to momopon1415, who reported the issue through the Wordfence Bug Bounty Program and received a $975 bounty. Wordfence framed the report as part of its defense-in-depth approach to WordPress security, which it says relies on vulnerability research, coordinated disclosure and layered protections.
What site owners should do now
The most important step is straightforward: update TranslatePress to version 3.3.2 as soon as possible. Because the flaw can lead directly to administrator takeover, leaving an older version in place creates unnecessary risk even if the exploitable condition appears limited.
Site owners should also review whether administrator profiles use a secondary language in TranslatePress, especially on multilingual sites where localizations are common. Even if a site is not obviously exposed today, Wordfence’s advisory makes clear that the vulnerable behavior is tied to how the plugin stores translated email content.
- Update TranslatePress to version 3.3.2 immediately.
- Check whether Wordfence firewall protection is active on the site.
- Review administrator account language settings.
- Enable two-factor authentication on admin accounts.
- Consider passkeys as a stronger passwordless login option.
Why layered login protection still matters
Wordfence used the advisory to highlight the value of two-factor authentication and passkeys. In a password reset attack, a password alone is not enough if a second factor is required, and passkeys can reduce exposure further because they do not rely on a reusable shared secret in the same way as passwords.
That matters here because the vulnerability targets the traditional password-reset flow. Even when a reset link is exposed, a site with stronger authentication controls can still narrow the attacker’s options and limit the damage.
Vendor response was quick
Wordfence said Cozmoslabs responded promptly after receiving the disclosure details and released the fully patched version the same day it acknowledged the report. The fast turnaround is notable because it reduced the window in which the flaw could remain unpatched across a plugin installed on hundreds of thousands of sites.
For WordPress site owners, the takeaway is simple: critical plugin vulnerabilities can turn small configuration details into serious exposure. In this case, a multilingual feature meant to improve the editing experience also created a path to expose admin reset links under the right conditions.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: August 26, 2026 at 1:52 am
0 views
