CVE-2026-78267 Overview
CVE-2026-78267 is an unauthenticated privilege escalation vulnerability affecting the TranslatePress Multilingual plugin for WordPress in versions up to and including 3.3.2. The flaw allows a remote, unauthenticated attacker to elevate privileges within a WordPress site without any user interaction. The vulnerability is categorized under [CWE-266: Incorrect Privilege Assignment]. Successful exploitation gives an attacker administrative control over the affected WordPress installation, exposing site content, user data, and connected infrastructure.
Critical Impact
An unauthenticated attacker can escalate privileges over the network with low complexity and no user interaction, leading to full compromise of the WordPress site.
Affected Products
- TranslatePress Multilingual plugin for WordPress, versions <= 3.3.2
- WordPress sites running the vulnerable plugin build
- Any multilingual site relying on TranslatePress for translation management
Discovery Timeline
- 2026-08-24 - CVE-2026-78267 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-78267
Vulnerability Analysis
The vulnerability is a privilege escalation issue in the TranslatePress Multilingual plugin. An attacker reaches the vulnerable code path over the network without authenticating or interacting with a legitimate user. Once exploited, the attacker gains elevated privileges inside the WordPress site, which can lead to arbitrary content modification, plugin installation, and administrator-level access. The issue is tracked under [CWE-266: Incorrect Privilege Assignment], indicating that a role or capability is assigned to an entity that should not receive it.
WordPress plugins that handle user roles or capabilities during frontend or AJAX flows are a recurring target for this class of flaw. Compromise of a single administrative account typically results in full site takeover, followed by webshell deployment, SEO poisoning, or pivoting to the underlying hosting environment.
Root Cause
The root cause is improper enforcement of privilege boundaries within TranslatePress <= 3.3.2. A code path exposed to unauthenticated requests assigns or accepts a higher privilege level than the caller is entitled to. Technical specifics are documented in the Patchstack Vulnerability Report.
Attack Vector
An attacker sends crafted HTTP requests to the WordPress site running the vulnerable TranslatePress plugin. No credentials, tokens, or user interaction are required. Because the plugin is commonly deployed on public-facing multilingual sites, exposure is broadly reachable from the internet. After escalation, the attacker leverages standard WordPress administrative functions to persist, exfiltrate data, or deploy additional malicious plugins and themes.
Refer to the Patchstack Vulnerability Report for endpoint-level detail. No public proof-of-concept code is currently listed in the enriched data.
Detection Methods for CVE-2026-78267
Indicators of Compromise
- Unexpected new WordPress administrator accounts or role changes in wp_users and wp_usermeta tables.
- Anomalous POST requests to TranslatePress plugin endpoints from unauthenticated sessions.
- Installation of unfamiliar plugins or themes shortly after suspicious TranslatePress traffic.
- Modifications to wp-config.php, .htaccess, or theme files not tied to a known deployment.
Detection Strategies
- Alert on privilege changes where an unauthenticated or low-privilege session transitions to an administrator role.
- Correlate web server access logs for repeated requests to TranslatePress paths (/wp-content/plugins/translatepress-multilingual/) with subsequent user creation events.
- Monitor WordPress audit logs for role assignments, add_user_meta writes to wp_capabilities, and new session tokens tied to newly created accounts.
Monitoring Recommendations
- Ingest WordPress application logs, web server access logs, and database audit events into a centralized analytics platform for correlation.
- Enable file integrity monitoring on the WordPress installation, particularly wp-content/plugins/ and core PHP files.
- Track outbound connections from the web host to detect callbacks, webshell staging, or data exfiltration after suspected exploitation.
How to Mitigate CVE-2026-78267
Immediate Actions Required
- Update the TranslatePress Multilingual plugin to a version above 3.3.2 as published by the vendor.
- Audit all WordPress user accounts and remove any administrator accounts that cannot be attributed to a known operator.
- Rotate credentials, application passwords, and API keys for any account that had access to the affected site.
- Review installed plugins and themes for unauthorized additions and remove anything not part of the approved baseline.
Patch Information
Refer to the Patchstack Vulnerability Report for the fixed version and vendor guidance. Apply the patched TranslatePress release from the official WordPress plugin repository or the vendor's distribution channel.
Workarounds
- Disable and remove the TranslatePress plugin until the site can be updated to a patched version.
- Restrict access to WordPress administrative and plugin endpoints using a web application firewall (WAF) rule set that blocks unauthenticated privilege-changing requests.
- Enforce IP allowlisting for /wp-admin/ and any TranslatePress-specific AJAX endpoints where feasible.
# Example: temporarily disable the plugin via WP-CLI while planning the patch
wp plugin deactivate translatepress-multilingual
wp plugin status translatepress-multilingual
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
