A critical TranslatePress vulnerability patched on August 13, 2026 let an unauthenticated attacker steal a WordPress administrator’s password-reset link and take over the account. TranslatePress is a translation plugin running on more than 400,000 sites. Wordfence disclosed the bug, tracked as CVE-2026-19632 with a CVSS score of 9.8, on August 26 after confirming the fix. If you run TranslatePress and haven’t updated to 3.3.2 or later, do it before you finish reading this.
How CVE-2026-19632 Actually Works
The flaw sits in the plugin’s trp_get_translations_regular AJAX action. When a WordPress admin’s profile is set to a published secondary language, TranslatePress intercepts outgoing emails, including password-reset emails, and translates them before they go out. With automatic string saving turned on, which is the default setting, the plugin writes that translated content, reset key and all, into a language-specific dictionary table in the database.
That table is readable through the same AJAX action any visitor’s browser can call. An attacker who knows or guesses an admin’s username or email address triggers a password reset, pulls the leaked reset URL out of the dictionary table before it expires, and logs in as that admin. No credentials, no prior access, nothing beyond a username needed.
Who Needs to Act
Every site on TranslatePress 3.3.1 or earlier is affected, but the attack path only exists when two conditions line up: automatic string saving is on (again, the default) and at least one admin’s account uses a published secondary language rather than the site’s default. A lot of multilingual WordPress sites, which is the entire point of running TranslatePress, meet both. Sites that only use the default language for admin accounts weren’t exposed the same way, but there’s no good reason to stay on a vulnerable version either way.
The fix is a straightforward plugin update to 3.3.2, no configuration changes required. If your site has been on an outdated version for a couple of weeks, it’s worth also checking recent admin logins and resetting passwords for any account that looks unfamiliar, since the vulnerability has been public for a few days now.
This is also a good reminder that plugin update hygiene matters more on sites carrying translation, forms, or membership plugins that touch account credentials directly. A WordPress security and maintenance review catches exactly this kind of exposure before it turns into an incident, especially on multilingual or membership-heavy builds. It’s the same category of bug we covered recently in the User Profile Builder admin takeover flaw and the Elementor Pro file upload bug: unauthenticated, critical severity, and fixed the moment you update.
