A critical vulnerability in the TranslatePress WordPress plugin, tracked as CVE-2026-19632, could allow unauthenticated attackers to hijack administrator accounts and gain complete control of vulnerable WordPress websites. The flaw affects TranslatePress versions up to and including 3.3.1 and has been patched in version 3.3.2. Wordfence rated the vulnerability CVSS (Critical), while the plugin has more than 400,000 active installations. Security researcher responsibly reported the issue through Wordfence’s Bug Bounty Program,

The vulnerability exists in the way TranslatePress handles WordPress password-reset emails and automatically saves translatable strings. When an administrator requests a password reset, WordPress generates an email containing a reset URL with a plaintext reset key and login parameters. Under the affected configuration, TranslatePress intercepts this email through wp_mail() and stores the reset URL in its secondary-language translation dictionary. This occurs when automatic string saving is enabled, which is the default setting, and the targeted administrator’s profile language is configured to use a published secondary language rather than the website’s default language.

The exposed translation data can then be retrieved through TranslatePress’s publicly accessible trp_get_translations_regular AJAX action. Because the endpoint accepts attacker-controlled string identifiers and returns matching translation records, an unauthenticated attacker could enumerate translation entries and potentially locate a stored administrator password-reset URL. If the attacker knows the administrator’s username or email address, they could trigger a password-reset request, retrieve the exposed reset link, set a new password, and authenticate as the administrator. Successful exploitation could result in full website compromise, including creating privileged accounts, installing malicious plugins or themes, modifying website content, stealing sensitive information, or using the compromised site to distribute malware.

The vulnerability does not affect every TranslatePress installation under identical conditions because exploitation depends on the administrator using a published secondary-language profile locale. Wordfence reported the issue to TranslatePress developer Cozmoslabs on August 12, 2026, after receiving the report on August 11, and the vendor released TranslatePress 3.3.2 on August 13, 2026. Site owners should immediately update TranslatePress to 3.3.2 or later, enable two-factor authentication or passkeys, restrict the number of administrator accounts, review account and user activity for suspicious password resets or logins, and inspect installed plugins and themes for unauthorized modifications or newly created privileged accounts.