Published on August 27, 2026
[CVE-2026-19632] Critical WordPress TranslatePress Bug Enables Complete Site Takeover
Severity
Critical
Detail
A critical vulnerability in the TranslatePress WordPress plugin, which is installed on more than 400,000 websites, could allow unauthenticated attackers to take over administrator accounts and gain full control of affected websites. Tracked as CVE-2026-19632, the vulnerability has a CVSS score of 9.8 (Critical) and affects TranslatePress versions 3.3.1 and earlier.
The vulnerability resides in the trp_get_translations_regular AJAX action, which may expose administrator password reset URLs, including the reset key, without requiring authentication. An attacker who knows an administrator’s username or email address can trigger a password reset request and retrieve the reset link from the plugin’s translation dictionary.
Successful exploitation could allow attackers to reset an administrator’s password, access the WordPress administration dashboard, install malicious plugins, modify website content, and steal sensitive data. The attack specifically affects administrator accounts configured to use a published secondary language.
| CVE ID | Summary | CVSS Score |
| CVE-2026-19632 | Sensitive Information Exposure vulnerability in TranslatePress allowing unauthenticated attackers to obtain administrator password-reset information and potentially take complete control of affected WordPress sites. | 9.8 (Critical) |
Affected Products
The vulnerability affects TranslatePress installations using:
- TranslatePress versions 3.3.1 and earlier.
- WordPress websites with TranslatePress configured to automatically save translatable strings.
- Administrator accounts whose profile language is configured to a published secondary language are specifically exposed to the described password-reset attack chain.
Recommendation
Organizations should implement the following measures immediately to reduce the risk of exploitation:
- Upgrade TranslatePress to version 3.3.2 or the latest available version immediately.
- Enable two-factor authentication (2FA) for all WordPress administrator accounts. This provides an additional layer of protection even if an attacker obtains a valid password-reset link.
- Review administrator accounts for unauthorized password changes, newly created accounts, or unexpected changes to account settings.
- Review WordPress plugins for unauthorized or recently installed plugins, particularly plugins that could provide persistence or backdoor functionality.
Source
https://cyberpress.org/critical-wordpress-translatepress-bug/