A newly discovered weak point in the TranslatePress WordPress plugin puts over 400,000 websites at serious risk of account takeover attacks. The vulnerability, identified as CVE-2026-19632, affects all TranslatePress versions up to 3.3.1. It allows unauthenticated attackers to hijack administrator-level accounts unless site owners update to 3.3.2 or later.
How the Flaw Works
The issue traces back to how TranslatePress handles password reset emails when translating outgoing messages. The plugin intercepts WordPress’s standard mail function, wp_mail(), to allow translation of those emails. When an admin requests a password reset, WordPress sends a URL—including a plaintext reset key and login parameters. Under certain conditions, TranslatePress stores that URL inside a translation dictionary table tied to secondary languages (languages added beyond the site’s default), but only if automatic string saving is enabled—which it is by default.
If the admin user’s profile is configured to use a published secondary language instead of the default, that password reset URL can end up exposed. Researchers found that TranslatePress includes a publicly accessible AJAX endpoint—trp_get_translations_regular—that returns translation entries. Attackers can exploit it by supplying identifiers and retrieving stored translation strings, which may include the reset URL.
What Attackers Can Do
With knowledge of an administrator’s username or email, an attacker could trigger a reset, pull the URL from the translation dictionary, reset the admin’s password, and gain full access to the site. Once inside, they could install malicious code, backdoored themes or plugins, steal data, or use the compromised site to spread malware.
That said, not every TranslatePress installation is vulnerable in the same way. An exposure only occurs when the site uses a secondary language for the admin profile and string autosaving is active—both default setups, but not universal. Admins using the site’s default language are unaffected by this particular chain.
Timeline and Severity
The vulnerability was reported by independent researcher momopon1415 via the Wordfence Bug Bounty Program. Wordfence assigned it a CVSS score of 9.8, marking it critical. The issue was made known to TranslatePress’ developer, Cozmoslabs, on August 12, 2026. The fix was released just a day later, on August 13, in version 3.3.2. The vulnerability disclosure itself came to light on August 26, 2026.
What Website Owners Must Do Now
Site operators using TranslatePress should immediately update to version 3.3.2 or anything newer. Additional security steps are strongly advised: enable two-factor authentication or passkeys for admin accounts, reduce the number of administrator users, monitor logs and user activity, and scan installed themes and plugins to ensure no unauthorized modifications have already occurred.
This vulnerability is especially dangerous for businesses, publishers, e-commerce platforms, and any organization relying on multilingual content—if they use TranslatePress under the vulnerable setup, their whole site could be at risk. Those not using secondary language settings for admin profiles, or who have string saving disabled, may already be insulated.
While this bug exposes a very high risk, the swift discovery and patch release demonstrate that responsible disclosure still works. What remains critical is how website owners respond: failure to update or tighten security could turn a plugin meant to expand international reach into a vector for total account takeover.
