471/69 Friday, August 28, 2026
Wordfence has disclosed a Critical vulnerability, CVE-2026-19632, in the TranslatePress plugin for WordPress, which is installed on more than 400,000 websites. The vulnerability has a CVSS severity score of 9.8 and could allow unauthenticated attackers to access the password reset URL for an administrator account, including the reset key and login information. Attackers could then use this information to change the password and take over the account. The vulnerability affects TranslatePress version 3.3.1 and earlier.
The vulnerability occurs when automatic string saving is enabled and the administrator account profile is set to a secondary language published on the website. Under these conditions, password reset emails are processed through TranslatePress’s translation system, causing the password reset URL to be stored in the translation database. An attacker who knows the administrator’s username or email address can request a password reset, then use the trp_get_translations_regular AJAX function to retrieve the stored URL and reset key. The attacker can then set a new password and gain access to the administrator account. However, if two-factor authentication (2FA) is enabled, it may help prevent the attacker from logging in.
The developer fixed CVE-2026-19632 in TranslatePress version 3.3.2, released on August 13, 2026. WordPress.org currently lists version 3.3.4 as the latest version because version 3.3.2 was still affected by a Stored Cross-Site Scripting (XSS) vulnerability, CVE-2026-66582. Website administrators using TranslatePress should update to version 3.3.4 or later to reduce the risk from these vulnerabilities.
Source: https://hackread.com/account-takeover-flaw-translatepress-plugin-wordpress/