CVE-2026-89278

The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.34.6 via the enqueue_frontend_scripts. This makes it possible for unauthenticated attackers to extract the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation) — a credential granting billed account access — by fetching any public page and applying the inverse transformation bundled in the plugin's own public JavaScript asset. This exposure affects the default configuration (gpt-3.5-turbo in client mode) and all supported non-DeepSeek providers; only deepseek-* models and gpt-* models configured in server-proxy mode correctly suppress key emission.

• CWE-200

• https://plugins.trac.wordpress.org/browser/gptranslate/tags/2.34.6/gptranslate.php#L2142
• https://plugins.trac.wordpress.org/browser/gptranslate/tags/2.34.6/gptranslate.php#L2205
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3693232%40gptranslate&new=3693232%40gptranslate
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b7676362-4373-4c9a-b3cd-73fad9ff5477?source=cve

Published

Sep 18, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89268QloApps through 1.7.0 renders back-office list filter POST p…5.4
• CVE-2026-8927When reusing a libcurl handle for sequential transfers drive…9.1
• CVE-2026-89274The WP Recipe Maker plugin for WordPress is vulnerable to Ar…9.1
• CVE-2026-89275Adobe Campaign Classic (ACC) is affected by an Improper Cont…10
• CVE-2026-89276Adobe Campaign Classic (ACC) is affected by an Improper Cont…9.9
• CVE-2026-89277CAI Content Credentials is affected by an Integer Overflow o…5.5
• CVE-2026-89281The Apache Lounge Windows distribution of Apache HTTP Server…8.4
• CVE-2026-89282The Apache Lounge Windows distribution of Apache HTTP Server…9.1
• CVE-2026-89298A flaw was found in the Dynamic Client Registration service …4.9
• CVE-2026-89307The "Firma Circolare" feature in the "Design Scuole Italia" …5.1
• CVE-2026-89308An unauthenticated OS command injection vulnerability exists…9.3
• CVE-2026-8931A critical Remote Code Execution (RCE) vulnerability exists …9.4