Sensitive Information Exposure in GPTranslate Plugin for WordPress
CVE-2026-89278

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Gptranslate – Multilingual Ai Translation Agent For WordPress: Translate Your Site With Ai
Vendor
CVE Published:
18 September 2026

What is CVE-2026-89278?

The GPTranslate plugin for WordPress is subject to a vulnerability that allows unauthenticated users to access sensitive API keys from third-party AI translation services. This exposure occurs through unsecured front-end scripts, making it possible for attackers to retrieve plaintext credentials, which can grant access to billed accounts. The issue affects all versions of the plugin up to and including version 2.34.6, presenting a significant risk particularly for those using the default client mode configuration. Implementing corrective measures is essential to safeguard against unauthorized data access and protect user privacy.

Affected Version(s)

GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI 0 <= 2.34.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/gptranslate/ta...
https://plugins.trac.wordpress.org/browser/gptranslate/ta...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Supakiad S. (m3ez)
.