FHN 
A critical security flaw in the TranslatePress WordPress plugin could allow attackers to take control of administrator accounts without needing to log in first.
Tracked as CVE-2026-19632, the vulnerability affects TranslatePress versions up to 3.3.1. The plugin has more than 400,000 active installations, making the issue important for a large number of WordPress websites.
The vulnerability has a CVSS score of 9.8, placing it in the critical category. It has been fixed in TranslatePress 3.3.2.
How the Vulnerability Can Be Exploited
The problem is related to how TranslatePress handles password-reset emails and stores text that can be translated.
Under certain settings, a password-reset link generated for an administrator can accidentally be saved inside the plugin’s translation data. This link contains information that could allow someone to reset the administrator’s password.
The affected translation data can then be accessed through a publicly available AJAX function in the plugin.
An attacker who knows an administrator’s username or email address could potentially:
- Request a password reset
- Find the exposed reset link
- Set a new administrator password
- Log in and take control of the website
Administrator Access Can Lead to Full Takeover
Successful exploitation could give an attacker administrator-level access to the affected WordPress site.
Once inside, an attacker could install malicious plugins, modify themes, create additional administrator accounts, change website content, or access sensitive information.
The vulnerability does not affect every TranslatePress installation under the same conditions. The exposure depends on how the administrator’s language settings and the plugin’s translation features are configured.
The issue was responsibly reported to Wordfence, which worked with TranslatePress developer Cozmoslabs to address the problem. A security update was released on August 13, 2026.
Update TranslatePress Immediately
Website owners using TranslatePress should update to version 3.3.2 or later as soon as possible.
Administrators should also review their websites for unexpected changes, unfamiliar user accounts, or newly installed plugins and themes. Enabling two-factor authentication or passkeys can provide another layer of protection for administrator accounts.
Keeping WordPress plugins updated is especially important because a vulnerable plugin can become an entry point to the entire website.
About the Author
