CVE-2026-19632: TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trpgettranslationsregular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: TranslatePress – Translate Multilingual sites with AI Translationto a version that resolves this vulnerability.Fixed in 3.3.1 - Configuration
Disable automatic string saving in TranslatePress, since the vulnerability is exploitable only when automatic string saving is enabled (default).
TranslatePress – Translate Multilingual sites with AI Translation (WordPress) automatic string saving = disable - Configuration
Ensure the target administrator's profile locale is not set to a published secondary language, since the password-reset URL is persisted in the secondary-language dictionary table under that condition.
WordPress (administrator profile) profile locale (administrator) = set to primary language (not a published secondary language)
Event History
Frequently Asked Questions
Which sites are exposed in practice?
Exposure requires automatic string saving to be enabled and a target administrator’s profile locale to be set to a published secondary language. Automatic string saving is enabled by default, but the administrator locale and published secondary-language condition must also be present.
Does exploitation require an account or user interaction?
No. The affected AJAX action can be accessed by an unauthenticated attacker, and no user interaction is required.
What can an attacker obtain and do?
An attacker can extract a raw administrator password-reset URL containing the plaintext reset key and login parameters from the secondary-language translation dictionary table. The reset link can then be used to take over the administrator account.