400,000 WordPress Sites Affected by Account Takeover Vulnerability in TranslatePress WordPress Plugin
Wordfence disclosed an unauthenticated account takeover flaw in the TranslatePress WordPress plugin, installed on over 400,000 sites, enabling full admin compromise.
On August 11, 2026, Wordfence received a submission for an unauthenticated account takeover vulnerability in TranslatePress, a WordPress plugin with more than 400,000 active installations. Unauthenticated attackers can obtain an administrator's password reset link, reset the account's password, and log in as that administrator. Full compromise of the affected site is possible without any authentication. Exploitation in the wild was not reported at disclosure.
- Unauthenticated attacker obtains an admin's password reset link and logs in as that administrator
- TranslatePress has more than 400,000 active WordPress installations
- Complete site takeover is possible without authentication
- Vulnerability submission received by Wordfence on August 11, 2026
- Products
- TranslatePress
- Organizations
- Wordfence
From the original article
On August 11th, 2026, we received a submission for an Unauthenticated Account Takeover vulnerability in TranslatePress, a WordPress plugin with more than 400,000 active installations. This vulnerability makes it possible for unauthenticated attackers to obtain an administrator's password reset link, reset the account's password, and log in as that administrator, resulting in complete site takeover.
By István Márton · wordfence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.