CVE-2026-19632 CRITICAL

CVE-2026-19632: TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure

Vendor Cozmoslabs
Product TranslatePress – Translate Multilingual sites with AI Translation
Weakness CWE-640 · Weak password recovery
Published August 26, 2026
Last update August 26, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.

Explanation of Vulnerability in Simple Terms

02Summary

TranslatePress versions up to 3.3.1 contain a weak password recovery mechanism that allows attackers to reset user passwords without proper verification. An attacker can gain unauthorized access to WordPress sites by exploiting predictable or bypassable password reset tokens. No authentication or user interaction is required to exploit this vulnerability.

What an attacker can do

03Attacker Capabilities

Reset any user's password and gain full access to the WordPress site.

Potential impact on your site

04Site Impact

Attackers can take over admin accounts and compromise your entire WordPress installation.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

August 26, 2026 CVE published

Related vulnerabilities

08Related CVE

CVE-2023-7264 Build App Online <= 1.0.22 - Account Takeover via Weak Password Reset Mechanism CVE-2024-9302 App Builder – Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP CVE-2024-12295 BoomBox Theme Extensions <= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password CVE-2026-12949 Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter CVE-2026-66691 WordPress Nokri theme <= 1.6.6 - Broken Access Control vulnerability