CVE-2026-19632

TranslatePress – Translate Multilingual sites with AI Translation for WordPress, in all versions up to and including 3.3.1, leaks sensitive data through its unauthenticated 'trp_get_translations_regular' AJAX action (CWE-640). When automatic string saving is enabled (the plugin's default) and an administrator's profile locale is set to a published secondary language, the raw password-reset URL — containing the plaintext reset key and login parameters — is persisted in the secondary-language translation dictionary table. An unauthenticated attacker can then retrieve these stored strings via the AJAX endpoint and use the leaked reset key to take over the administrator account. Any WordPress site running the affected versions under those configuration conditions is exposed. No public proof-of-concept or confirmed exploitation is known; the flaw is not in CISA KEV and EPSS estimates a 0.8% probability of exploitation within 30 days.

What to do: Update TranslatePress to a release newer than 3.3.1 as soon as a patched version is available. Until then, disable automatic string saving or ensure administrator profiles are not set to published secondary-language locales, and inspect secondary-language translation dictionary tables for stored password-reset URLs. If any reset URLs were stored, trigger fresh password resets for affected administrator accounts to invalidate the exposed reset keys.