Critical Account Takeover Vulnerability in TranslatePress WordPress Plugin Affects Over 400,000 Sites

A critical vulnerability affecting over 400,000 WordPress sites has been discovered in the popular TranslatePress plugin. The flaw, identified as CVE-2026-19632, allows unauthenticated attackers to take complete control of a WordPress site by exploiting a weakness in the password reset mechanism.

The vulnerability arises from how TranslatePress handles password reset emails and its automatic string saving feature. When an administrator, whose profile language is set to a published secondary language, initiates a password reset, the plugin processes the reset email. If automatic string saving is enabled, which is the default setting, the password reset URL, including the sensitive reset key, is persisted within the plugin's translation dictionary tables for secondary languages.

Attackers can then exploit this by triggering a password reset for an administrator account. By accessing the plugin's AJAX action trp_get_translations_regular, they can extract the raw administrator password-reset URL from the stored translation strings. This extracted URL contains the plaintext reset key, enabling the attacker to reset the administrator's password and gain full access to the website.

Wordfence researchers received a submission for this vulnerability on August 11th, 2026, and confirmed its severity. The exploit is only possible under specific conditions: automatic string saving must be enabled, and the target administrator's profile locale must be set to a published secondary language. Despite these conditions, the widespread use of TranslatePress means a significant number of sites remain at risk.

Upon discovery, Wordfence provided full disclosure details to the Cozmoslabs team, the developers of TranslatePress, on August 12th, 2026. The development team responded promptly, acknowledging the report on August 13th and releasing a patched version, 3.3.2, on the same day. This swift action by the developers is commendable.

Wordfence has implemented a firewall rule to protect its Premium, Care, and Response users against exploits targeting this vulnerability, with protection deployed on August 13th, 2026. Users of the free Wordfence plugin will receive the same protection starting September 12th, 2026.

Given the critical nature of this vulnerability and the potential for complete site takeover, WordPress site administrators are strongly urged to update their TranslatePress plugin to version 3.3.2 or later immediately. This update is crucial to mitigate the risk of unauthorized access and protect their websites from compromise.

The vulnerability carries a CVSS rating of 9.8, classifying it as Critical. The discovery was made by researcher momopon1415, who was awarded a $975 bounty through the Wordfence Bug Bounty Program.