CVE-2026-19632: TranslatePress Information Disclosure

CVE-2026-19632 Overview

CVE-2026-19632 is a sensitive information exposure vulnerability in the TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress. The flaw affects all versions up to and including 3.3.1 and stems from the trp_get_translations_regular AJAX action. Unauthenticated attackers can extract raw administrator password-reset URLs, including the plaintext reset key and login parameters stored in the translation dictionary table. Successful exploitation leads to full administrator account takeover. The issue is classified under [CWE-640: Weak Password Recovery Mechanism for Forgotten Password].

Critical Impact
Unauthenticated attackers can harvest administrator password-reset URLs from the translation dictionary and seize full control of the WordPress site.

Affected Products

TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress
All versions up to and including 3.3.1
Installations where automatic string saving is enabled (default) and an administrator's profile locale is a published secondary language

Discovery Timeline

2026-08-26 - CVE-2026-19632 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in the NVD database

Technical Details for CVE-2026-19632

Vulnerability Analysis

The vulnerability resides in TranslatePress's translation dictionary workflow. When automatic string saving is enabled and an administrator has a secondary language set as their profile locale, TranslatePress persists rendered page strings — including transient URLs — into the secondary-language dictionary table. WordPress password-reset emails render through this pipeline when the admin requests a reset in their locale. The reset URL, containing the plaintext reset key and login parameter, is stored as a translatable string.

The trp_get_translations_regular AJAX endpoint returns dictionary entries without authentication checks. Unauthenticated attackers query the endpoint and retrieve the stored reset URL directly. The attacker then visits the URL to set a new administrator password.

Root Cause

The root cause is missing authorization on the trp_get_translations_regular AJAX action combined with insecure persistence of sensitive dynamic content. TranslatePress treats every rendered string as translatable, including URLs that contain security-sensitive tokens. Password-reset links have a limited lifetime but remain valid long enough for an attacker polling the dictionary to reuse them. [CWE-640] applies because the recovery mechanism exposes reset material to unauthenticated actors.

Attack Vector

An unauthenticated remote attacker sends a crafted request to admin-ajax.php invoking the trp_get_translations_regular action against a vulnerable WordPress site. The response contains dictionary entries harvested from prior page renders. When an administrator with a secondary-language locale triggers or receives a password-reset email, the reset URL becomes part of that dictionary. The attacker parses the response, extracts the URL containing the reset key and login values, and completes the password reset to gain administrator access. See the Wordfence Vulnerability Report and the TranslatePress API Regular Strings source for the vulnerable handler.

No verified public exploit code is available at this time. Refer to the TranslatePress Changeset 3645229 for the corresponding fix commit.

Detection Methods for CVE-2026-19632

Indicators of Compromise

Unauthenticated HTTP POST requests to /wp-admin/admin-ajax.php with the action=trp_get_translations_regular parameter from external IPs.
Presence of dictionary rows in TranslatePress tables containing wp-login.php?action=rp&key= strings or login= parameters.
Unexpected administrator password changes or successful logins from unfamiliar IP addresses shortly after AJAX dictionary queries.
WordPress audit log entries showing password-reset requests followed by administrator profile modifications.

Detection Strategies

Inspect webserver access logs for repeated or high-volume calls to trp_get_translations_regular originating from unauthenticated sessions.
Query the TranslatePress dictionary tables for stored strings matching password-reset URL patterns and flag any matches for immediate review.
Correlate WordPress password_reset events with subsequent administrator authentication from previously unseen IP addresses or user agents.

Monitoring Recommendations

Enable verbose logging on admin-ajax.php and forward events to a centralized SIEM for anomaly analysis.
Monitor WordPress user role changes, new administrator creations, and plugin or theme modifications in near real time.
Alert on any secondary-language dictionary write that contains URL query strings including key, login, or action=rp.

How to Mitigate CVE-2026-19632

Immediate Actions Required

Update the TranslatePress plugin to the version published in Changeset 3645229, which is the release following 3.3.1.
Rotate all administrator passwords and invalidate active WordPress sessions after patching.
Purge existing TranslatePress dictionary entries that contain reset URLs, key=, or login= parameters.
Review recent administrator logins and audit user role changes to confirm no unauthorized access has occurred.

Patch Information

The TranslatePress maintainers addressed the flaw in the release following version 3.3.1. The fix is tracked in Changeset 3645229. WordPress administrators should apply the update through the WordPress plugin dashboard or WP-CLI as soon as possible.

Workarounds

Disable automatic string saving in TranslatePress settings until patching is complete, since the exposure requires this default setting to be enabled.
Change any administrator profile locale set to a published secondary language back to the site's primary language.
Restrict access to /wp-admin/admin-ajax.php from untrusted networks using a web application firewall (WAF) rule that blocks unauthenticated calls to the trp_get_translations_regular action.
Temporarily deactivate the TranslatePress plugin if no other mitigation is feasible.

bash

# Example WAF rule (ModSecurity syntax) to block unauthenticated calls
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026019632,\
   msg:'Block CVE-2026-19632 TranslatePress AJAX abuse'"
  SecRule ARGS:action "@streq trp_get_translations_regular" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"