Sensitive Information Exposure in TranslatePress Plugin for WordPress

CVE-2026-19632

What is CVE-2026-19632?

CVE-2026-19632 is a critical vulnerability found in the TranslatePress plugin for WordPress, specifically affecting all versions up to and including 3.3.1. The plugin, which enables users to create multilingual websites using AI translation, is susceptible to an attack that results in the exposure of sensitive information. The vulnerability arises from the 'trp_get_translations_regular' AJAX action, which allows unauthenticated attackers to retrieve the raw administrator password-reset URL, including the plaintext reset key and login parameters stored in the translation dictionary table. This flaw can lead to unauthorized access to an administrator's account, putting the entire WordPress site at risk. The issue primarily manifests when automatic string saving is enabled—this is typically the default setting—and the administrator's profile locale is configured to a published secondary language. Under these conditions, the password-reset URL is inadvertently saved as a string in the secondary language’s translation dictionary, rendering it vulnerable to exploitation.

Potential impact of CVE-2026-19632

1. Administrator Account Takeover: The vulnerability enables attackers to gain full control over the administrator's account. This could lead to unauthorized actions, including changes to site settings, content manipulation, and complete site compromise.

2. Data Breach Risk: Once an attacker has administrative access, they can potentially access sensitive user data stored within the WordPress database. This could include personal information, payment details, and other confidential data, leading to privacy violations and loss of customer trust.

3. Widespread Site Compromise: With administrator access, attackers can deploy further malicious scripts or backdoors, potentially compromising the entire website, affecting site performance, availability, and leading to downstream impacts on users and consumers.

References