TranslatePress Account Takeover Vulnerability: CVE-2026-19632 Scope and Response

Vulnerability overview

TranslatePress adds multilingual translation and storage to WordPress sites. CVE-2026-19632 is an account takeover flaw caused by password-reset email content entering the plugin's translation pipeline. Under the affected configuration, an unauthenticated requester can retrieve a stored reset URL through a public AJAX action. The URL contains the key needed to complete account recovery. The issue has a CVSS score of 9.8, affects TranslatePress 3.3.1 and earlier, and is fixed in version 3.3.2.

The weakness is a boundary failure between ordinary translatable strings and one-time security secrets. A reset link should remain confined to the account owner's email. Instead, the message can be translated and persisted in a secondary-language dictionary, while a public translation lookup can return the stored row. Operators need to review the plugin version, language configuration, automatic string saving and administrator locale together.

Reset-link exposure path

An attacker first requests a WordPress password reset for a known administrator username or email address. The administrator does not need to open the message. If automatic string saving is enabled and the administrator profile uses a published secondary language, the reset email enters TranslatePress processing and is stored with the reset key still present.

The attacker then queries the public trp_get_translations_regular AJAX action and retrieves the stored translation row. The URL can be used in the legitimate WordPress recovery flow to choose a new password. TranslatePress does not directly write the password; the impact comes from disclosing a valid recovery secret through a translation-data interface.

Prerequisites and affected scope

• Affected: TranslatePress 3.3.1 and earlier
• Fixed starting with TranslatePress 3.3.2
• Required environment: a published secondary language used by the target administrator
• Relevant setting: automatic string saving enabled
• Potential outcome: administrator password reset and account access

The plugin page now offers a later maintenance release, so operators should install the latest stable version rather than treating 3.3.2 as a target ceiling. Disabling a language or the plugin can reduce the live path, but it does not review earlier account changes. The update and account review should be managed as one task.

Disclosure and fix timeline

The researcher submitted the issue on August 11, 2026. Wordfence validated it and disclosed it to the developer on August 12, and TranslatePress released version 3.3.2 on August 13. Detailed analysis followed on August 25. Verify the version actually running on every node, even when automatic updates are enabled.

Operational checks

Inventory every WordPress instance and record the TranslatePress version, activation state, published secondary languages and administrator profile locales. Review password-reset requests, administrator password changes, new administrators, email changes and unusual logins from the affected deployment period. Correlate WordPress records with web-server, WAF and identity logs; a public AJAX request alone does not prove account takeover.

Update and validation

1. Confirm the exact TranslatePress version on every WordPress instance.
2. Follow backup and change-control procedures, then install the latest stable release.
3. Clear caches and test public pages, language switching, translation editing and mail delivery.
4. Review administrator reset, login and privilege-change events from the affected period.
5. Use unique administrator credentials and enable two-factor authentication or passkeys.

Validation should include more than the version label. Confirm that deployment automation or stale nodes have not restored older plugin files, and test with an operator-owned account. Invalidate any test reset link afterward. Multi-factor authentication is defense in depth, not a substitute for the update. Close the response when the fixed release is active, multilingual functions work, account events are reviewed and administrator controls are documented.