{"id":"CVE-2026-19632","aliases":["EUVD-2026-66230","GHSA-p6fq-w74v-62gm"],"status":"published","title":"TranslatePress – Multilingual \u003c= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure","description":"The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.04502,"percentile":0.91571,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-640"],"published":"2026-08-26T03:39:22Z","modified":"2026-08-26T20:17:10Z","exploits":[{"source":"nuclei","id":"CVE-2026-19632","title":"TranslatePress \u003c= 3.3.1 - Unauthenticated Account Takeover","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-19632.yaml"},{"source":"pocgithub","id":"DeadExpl0it/CVE-2026-19632-POC","title":"DeadExpl0it/CVE-2026-19632-POC","date":"2026-08-26","url":"https://github.com/DeadExpl0it/CVE-2026-19632-POC"},{"source":"pocgithub","id":"TheJesterrrr/CVE-2026-19632","title":"TheJesterrrr/CVE-2026-19632","date":"2026-10-04","url":"https://github.com/TheJesterrrr/CVE-2026-19632"},{"source":"pocgithub","id":"YonLiud/CVE-2026-19632","title":"YonLiud/CVE-2026-19632","date":"2026-08-26","url":"https://github.com/YonLiud/CVE-2026-19632"}],"products":[{"vendor":"cozmoslabs","product":"translatepress – translate multilingual sites with ai translation"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4f4ebf09-b089-4118-a0ee-399243253f9c?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/class-translate-press.php#L531"},{"url":"https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/class-translation-render.php#L2371"},{"url":"https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/class-translation-render.php#L2061"},{"url":"https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/class-translate-press.php#L361"},{"url":"https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/class-translation-render.php#L2257"},{"url":"https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/class-editor-api-regular-strings.php#L35"},{"url":"https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/class-editor-api-regular-strings.php#L93"},{"url":"https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/queries/class-query.php#L1258"},{"url":"https://plugins.trac.wordpress.org/changeset/3645229/translatepress-multilingual"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19632"},{"url":"https://github.com/advisories/GHSA-p6fq-w74v-62gm"}],"sources":{"cve":[{"id":"CVE-2026-19632","title":"TranslatePress – Multilingual \u003c= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure","description":"The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.","status":"published","published":"2026-08-26T03:39:22.812Z","modified":"2026-08-26T18:51:39.601Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T13:47:28.691429Z"}],"euvd":[{"id":"EUVD-2026-66230","description":"The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.","status":"published","published":"2026-08-26T03:39:22Z","modified":"2026-08-26T18:51:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:01:29.635922Z"}],"ghsa":[{"id":"GHSA-p6fq-w74v-62gm","title":"The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is...","description":"The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.","status":"published","published":"2026-08-26T18:31:51Z","modified":"2026-08-26T18:31:52Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T15:10:59.944342Z"}],"nvd":[{"id":"CVE-2026-19632","description":"The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.","status":"published","published":"2026-08-26T05:18:06.81Z","modified":"2026-08-26T20:17:10.02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-640"],"updated_at":"2026-11-02T14:12:41.66469Z"}]}}