TranslatePress Flaw (CVE-2026-19632) Exposes 400,000 WordPress Sites to Account Takeover
Do Son 
TL;DR
A critical flaw in TranslatePress lets unauthenticated attackers steal an administrator’s password reset link. Attackers can then reset the password and seize the account. The bug affects versions up to and including 3.3.1, and version 3.3.2 fixes it.
Why This TranslatePress Account Takeover Matters
The TranslatePress account takeover flaw carries a CVSS score of 9.8, marking it critical. It affects TranslatePress, a plugin with more than 400,000 active installations according to Wordfence. Because the attack needs no login, the scale of exposure is large.
Tracked as CVE-2026-19632, the bug leaks an admin password reset URL to anonymous visitors. As a result, a single request can hand full control of a site to a stranger. Once inside, an attacker owns everything.
How the Attack Works
The problem comes from two plugin behaviors that combine badly. First, TranslatePress translates outgoing emails. It hooks into WordPress core through wp_mail_filter() and stores translatable strings in per-language dictionary tables.
Consequently, when an admin’s profile locale is set to a published secondary language, the reset email gets captured. With automatic string saving on by default, the full reset URL lands in the dictionary table. That URL includes the plaintext reset key.
Second, the plugin exposes a public AJAX action called trp_get_translations_regular. This action returns dictionary rows to anyone who asks. Therefore an attacker can trigger a reset, then read the stored link straight out of the database.
Wordfence explains the impact plainly. Their advisory states the flaw allows attackers to extract the raw administrator password-reset URL
, which enables full administrator account takeover
. Security researcher momopon1415 found and reported the issue through the Wordfence Bug Bounty Program.
Is It Being Exploited?
No exploitation in the wild has been confirmed. Likewise, no public proof-of-concept has appeared yet. Still, the low complexity makes fast patching essential.
Affected Versions
All TranslatePress versions up to and including 3.3.1 are vulnerable. The plugin uses the translatepress-multilingual slug. Wordfence estimates more than 400,000 sites run this software.
Exploitation needs two conditions. Automatic string saving must be enabled, which is the default. Also, the target admin’s locale must be set to a published secondary language.
Patch and Mitigation Steps
Update TranslatePress to version 3.3.2 right away. Cozmoslabs released the fix on August 13, 2026, the same day it confirmed the report. Wordfence commended the team for the quick turnaround.
If you cannot patch immediately, review admin profile language settings. In addition, watch for unexpected password reset requests. Prompt updates remain the safest path.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
