Critical WordPress TranslatePress Flaw Lets Attackers Take Over Admin Accounts

A critical vulnerability in the TranslatePress multilingual WordPress plugin could enable unauthenticated attackers to take control of administrator accounts and fully compromise affected websites.

This vulnerability, tracked as CVE-2026-19632, has a CVSS score of 9.8 and affects all TranslatePress versions up to 3.3.1.

The flaw affects a plugin installed on over 400,000 WordPress sites. Security researchers have warned that attackers can obtain an administrator’s password-reset URL, reset the account password, and log in with full administrative privileges.

To address this vulnerability, the developer Cozmoslabs released version 3.3.2 on August 13.

Critical WordPress TranslatePress Flaw

The vulnerability was identified and responsibly disclosed by Wordfence researcher momopon1415 through the company’s bug bounty program, earning a $975 reward.

The issue arises from how TranslatePress processes translated outgoing emails and stores strings for multilingual content.

TranslatePress integrates with WordPress’s `wp_mail()` function to translate messages sent to users. When an administrator account uses a published secondary language, the password reset email can be translated by the plugin.

When automatic string saving is enabled, the default configuration, the plugin retains the translated email content in a language-specific database dictionary. Unfortunately, the stored content includes the entire password reset URL, which includes a plaintext reset key and account login parameters.

Normally, password reset links should be accessible only to the intended recipient. In this case, TranslatePress can inadvertently persist the sensitive URL as a translatable string, creating an unintended copy within the website’s database.

The second component of this attack involves the `trp_get_translations_regular` AJAX action. TranslatePress uses this action to retrieve translation dictionary entries for specific string identifiers.

According to Wordfence’s technical analysis, an attacker can enumerate entries in a secondary-language translation dictionary and fetch the corresponding rows. If a password-reset URL has been saved in that dictionary, it can be revealed in plaintext.

An unauthenticated attacker who knows an administrator’s username or email address could trigger a password reset, retrieve the leaked reset link, and use it before it expires. The attacker could then set a new password and log in as the targeted administrator.

Having administrative access creates a high-impact compromise scenario. Attackers could add unauthorized administrator accounts, install backdoored plugins or themes, alter site content, inject malicious JavaScript, steal data, or exploit the compromised site for phishing or malware operations.

It’s important to note that the flaw is not present in every TranslatePress deployment under all circumstances. Exploitation requires that automatic string saving be enabled and that the targeted administrator’s profile language be set to a published secondary language.

If the administrator uses the site’s default language, the password-reset email will not pass through the vulnerable secondary-language translation workflow. As a result, the reset URL will not be stored in a dictionary table accessible through the affected functionality.

However, organizations should not consider these prerequisites as sufficient protection. Profile language settings can change, multiple administrators may use localized accounts, and attackers may target any privileged user who meets the necessary conditions.

Website owners should immediately update TranslatePress to version 3.3.2 or later. Administrators should also review WordPress user accounts, check installed plugins and themes for unauthorized changes, rotate administrator passwords, and invalidate suspicious sessions if a compromise is suspected.

Wordfence implemented a firewall rule for Premium, Care, and Response customers on August 13. Free Wordfence users are scheduled to receive the same rule on September 12.

Finally, WordPress administrators are encouraged to enable multi-factor authentication or passkeys. These controls can help prevent a password reset from granting access to the account, reducing the risk of credential-focused takeover attacks.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC