Critical TranslatePress WordPress Plugin Vulnerability Exposes Sites to Admin Account Takeover A severe security flaw in the TranslatePress WordPress plugin (CVE-2026-19632) could allow unauthenticated attackers to hijack administrator accounts and fully compromise affected websites. The vulnerability, rated 9.8 (critical) on the CVSS scale, impacts all versions of TranslatePress up to 3.3.1, with a patch released in version 3.3.2. The issue was discovered by security researcher momopon1415, who reported it through the Wordfence Bug Bounty Program and received a $975 reward. The flaw stems from how TranslatePress processes password reset emails and stores translatable strings. When an administrator requests a password reset, WordPress generates a reset URL containing a plaintext key. Under specific conditions including automatic string saving (enabled by default) and an administrator profile set to a published secondary language the plugin stores this sensitive URL in a translation dictionary table. Attackers could exploit this by using the plugin’s publicly accessible `trp_get_translations_regular` AJAX action to retrieve stored translation entries, including the password reset link. With knowledge of an administrator’s username or email, an attacker could trigger a reset, extract the exposed URL, set a new password, and gain full administrative access. Successful exploitation grants attackers control over the WordPress site, enabling them to create privileged accounts, install malicious plugins/themes, alter content, steal data, or distribute malware. The risk is particularly high for businesses, e-commerce stores, and publishers using TranslatePress. The vulnerability was reported to Wordfence on August 11, 2026, disclosed to the plugin developer Cozmoslabs on August 12, and patched in version 3.3.2 on August 13. Notably, the flaw only affects sites where administrators use a published secondary language those with default language settings are not impacted.