Reported by 3 outlets

Timeline

1. original reporting

   Critical WordPress TranslatePress Flaw Lets Attackers Take Over Admin Accounts

   gbhackers.com · 48d ago · August 26th, 2026

   A critical vulnerability in the TranslatePress multilingual WordPress plugin could enable unauthenticated attackers to take control of administrator accounts and fully compromise affected websites. This vulnerability, tracked as CVE-2026-19632, has a CVSS score of 9.8 and affects all TranslatePress versions up to 3.3.1. The flaw affects a plugin installed on over 400,000 WordPress sites. Security […] The post Critical WordPress TranslatePress Flaw Lets Attackers Take Over Admin Accounts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from malware.news

   400,000 WordPress Sites Affected by Account Takeover Vulnerability in TranslatePress WordPress Plugin

   malware.news · 49d ago · August 25th, 2026

   On August 11th, 2026, we received a submission for an Unauthenticated Account Takeover vulnerability in TranslatePress , a WordPress plugin with more than 400,000 active installations. This vulnerability makes it possible for unauthenticated attackers to obtain an administrator’s password reset link, reset the account’s password, and log in as that administrator, resulting in complete site takeover. It is important to note that the password reset key is only leaked if the target administrator’s profile language is set to a published secondary language. Props to momopon1415 who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program . This researcher earned a bounty of $975.00 for this discovery. Our mission is to secure WordPress through defense in depth, which is why we are investing in quality vulnerability research and collaborating with researchers of this caliber through our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element to the multi-layered approach to security. Wordfence Premium , Wordfence Care , and Wordfence Response users received a

3. update from cyberpress.org

   Critical WordPress TranslatePress Bug Enables Complete Site Takeover

   cyberpress.org · 48d ago · August 26th, 2026

   The issue is a Sensitive Information Exposure bug in the plugin’s trp_get_translations_regular AJAX action, which lets unauthenticated attackers extract a raw administrator password-reset URL including the plaintext reset key directly from the plugin’s translation dictionary table. Critical WordPress TranslatePress Bug TranslatePress hooks into WordPress’s wp_mail() function to translate outgoing emails, including password-reset messages, into an administrator’s preferred language. When automatic string saving is enabled (the default) and the targeted admin’s profile is set to a published secondary language, the full reset email, including the reset key and login parameters, gets stored as a translatable string in that language’s dictionary table. The plugin also exposes a public AJAX handler that returns dictionary rows for attacker-supplied string IDs without any authentication check. Wordfence Firewall (Source: Wordfence) By enumerating these entries, an attacker who knows an admin’s username or email ca