TranslatePress

CVE-2026-19632 is a critical TranslatePress vulnerability that can expose administrator password reset links from secondary-language dictionary tables. Update to 3.3.2 or newer immediately; WordPress.org currently lists 3.3.4.

Wordfence published CVE-2026-19632 on August 25, 2026 for TranslatePress – Translate Multilingual sites with AI Translation, a WordPress plugin with 400,000+ active installations. The flaw can let unauthenticated attackers obtain an administrator password reset link, reset that account, and take over the site.

The issue is conditional but critical. Wordfence says exploitation requires automatic string saving to be enabled, which is the default, and the target administrator’s profile locale must be set to a published secondary language. Under those conditions, the password reset email can be persisted into a secondary-language translation dictionary and later exposed through a public translation lookup path.

Table of Contents

Vulnerability Summary

CVE: CVE-2026-19632
Severity: CVSS 9.8 critical
Weakness: sensitive information exposure leading to account takeover
Required access: none
User interaction: none
Affected versions: TranslatePress up to and including 3.3.1
Fixed version: 3.3.2; WordPress.org currently lists 3.3.4
Install base: 400,000+ active installations

Technical Cause

TranslatePress can translate outgoing mail by passing message content through its translation pipeline. When an administrator using a published secondary profile language requests a password reset, the reset email can be captured as a translatable string. That email contains the WordPress reset URL with the reset key and login parameters.

The second part of the issue is that the plugin exposes dictionary rows through the trp_get_translations_regular AJAX action. If the reset URL has been saved into the secondary-language dictionary table, an unauthenticated request can retrieve it and use the reset key to set a new administrator password.

Immediate Remediation

Update TranslatePress to 3.3.2 or newer immediately. Prefer the current WordPress.org release, 3.3.4, unless your site has a tested version pin.
Enable two-factor authentication or passkeys for all administrator accounts.
Review administrator profile languages, especially accounts set to a published secondary language.
Check recent password reset activity and administrator login history.
Force logout of all administrator sessions and rotate credentials if suspicious reset activity is found.

WP-CLI Verification

wp plugin get translatepress-multilingual --fields=name,version,status
wp plugin update translatepress-multilingual
wp plugin get translatepress-multilingual --field=version

List administrator accounts and review recently modified users. These checks do not prove exploitation, but they identify accounts that need manual review after a password-reset disclosure.

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp db query "SELECT ID,user_login,user_email,user_activation_key FROM {prefix}users WHERE user_activation_key <> '';"

Dictionary Table Review

Use read-only database checks to find TranslatePress dictionary tables and then inspect any table that contains password reset URL fragments. Replace the table name in the second command with the actual dictionary table found on your site.

wp db query "SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME LIKE '{prefix}trp_dictionary_%';"
wp db query "SELECT id, original, translated FROM {prefix}trp_dictionary_en_us_es_es WHERE original LIKE '%wp-login.php?action=rp%' OR translated LIKE '%wp-login.php?action=rp%' LIMIT 20;"

Temporary Mitigation

The correct fix is the vendor patch. If you cannot update immediately, disable automatic string saving, ensure administrator profile languages use the default site language, and require 2FA before administrator login. These mitigations reduce exposure but should not be treated as a replacement for updating.

# Emergency containment only; update the plugin as the permanent fix.
wp plugin deactivate translatepress-multilingual