CVE-2026-19632

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.

• CWE-640

• https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/class-translate-press.php#L361
• https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/class-translate-press.php#L531
• https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/class-editor-api-regular-strings.php#L35
• https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/class-editor-api-regular-strings.php#L93
• https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/class-translation-render.php#L2061
• https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/class-translation-render.php#L2257
• https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/class-translation-render.php#L2371
• https://plugins.trac.wordpress.org/browser/translatepress-multilingual/tags/3.3.1/includes/queries/class-query.php#L1258
• https://plugins.trac.wordpress.org/changeset/3645229/translatepress-multilingual
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4f4ebf09-b089-4118-a0ee-399243253f9c?source=cve

Published

Aug 26, 2026

Last Modified

Aug 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19625When a Quarkus application has multiple endpoints secured by…5.3
• CVE-2026-19626A remote code execution vulnerability exists in Tenable Secu…9.9
• CVE-2026-19628A command injection vulnerability exists in Tenable Security…7.2
• CVE-2026-19629A privilege escalation vulnerability exists in Tenable Secur…8.1
• CVE-2026-1963A vulnerability was found in WeKan up to 8.20. This affects …9.8
• CVE-2026-19631A SQL injection vulnerability exists in Security Center that…4.9
• CVE-2026-19633PostgreSQL Anonymizer contains a vulnerability that allows u…8.8
• CVE-2026-19634PostgreSQL Anonymizer contains a SQL injection vulnerability…6.4
• CVE-2026-19635A local privilege escalation vulnerability exists in Securit…8.8
• CVE-2026-19636An issue was identified in which CSRF tokens were generated …5.3
• CVE-2026-19639An improper access control vulnerability exists where an aut…4.3
• CVE-2026-1964A vulnerability was determined in WeKan up to 8.20. This imp…5.3