External risk intelligence

TranslatePress Plugin Information Exposure Allows Administrator Account Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-19632

The vulnerability affects a WordPress plugin, which is a component of a web application. WordPress sites are frequently deployed as public-facing websites, and this flaw is reachable via a standard AJAX action that does not require authentication, making it accessible to remote internet users.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a popular WordPress plugin that allows for website translation. This issue could enable unauthorized individuals to access administrator account credentials, potentially leading to full control of your WordPress sites. The primary concern is to confirm if this plugin is in use and if the specific conditions for exploitation are met.

Sensitive data exposure in translation plugin.
Potential for administrator account takeover.
Confirm relevance and exposure on our sites.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by targeting a WordPress site using the TranslatePress plugin. If automatic string saving is enabled and an administrator's profile is set to a published secondary language, the system inadvertently stores sensitive password reset information as a translatable string. An unauthenticated attacker can then use a specific AJAX action to retrieve this stored information, gaining access to a raw administrator password-reset URL that includes the reset key and login parameters. This allows the attacker to take over an administrator account.

No authentication required to access.
AJAX action triggers sensitive data exposure.
Enables full administrator account takeover.

Live Threat

Current exploitation, exposure, and threat context

Under specific conditions, such as when automatic string saving is enabled and an administrator's profile is set to a published secondary language, this vulnerability could expose administrator password-reset URLs, including the reset key and login parameters. This exposure could enable an attacker to take over an administrator account.

Administrator account credentials.
Stored password reset URLs.
Full administrator account takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership of this critical vulnerability likely falls to the application or platform teams managing the WordPress instances, potentially with vendor-management teams coordinating with the plugin provider. The immediate practical first step is to identify all WordPress sites using this plugin, confirm their exposure (especially if automatic string saving is enabled and secondary languages are published), and determine the business criticality of each instance to prioritize remediation efforts.

Application owners should own this issue.
Verify affected plugin and settings first.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the TranslatePress plugin?

TranslatePress is a WordPress plugin used to translate website content into multiple languages. It functions by creating a dictionary of translatable strings found on the site. When users visit, the plugin swaps text to match their language settings. It includes features that automatically detect and save new strings as they appear, helping site owners maintain localized versions of their pages without manual input.

What does CWE-640 mean for CVE-2026-19632?

CWE-640 refers to Weak Password Recovery Mechanism for Underprivileged Entities. In this case, the vulnerability allows unauthorized access to password reset information. Instead of a secure, private reset process, the plugin inadvertently stores sensitive password-reset URLs—including the secret reset keys—within a database table meant for site translations. This exposes the data, allowing someone to intercept a reset URL and compromise an administrator account.

How is this vulnerability triggered?

An attacker triggers this by calling a specific AJAX function in the plugin. It only works if two settings are active: automatic string saving must be turned on, and an administrator's profile must be using a secondary, published language. If automatic string saving is disabled, or if the administrator's profile locale is not set to a secondary language, the password reset link is not captured in the translation dictionary, preventing this specific exposure.

Is my site at risk?

Halo Surface Signal indicates this issue is likely relevant to many users because the plugin is a component of public-facing WordPress websites. Since the vulnerability is reachable through a standard, unauthenticated AJAX action, it does not require a login to exploit. If your WordPress site is connected to the internet and uses this plugin, external actors can potentially send requests to your server to attempt to retrieve this sensitive information.

Do I need to take action?

Yes, start by checking your WordPress installations to see if the TranslatePress plugin is active. If found, verify if your current configuration uses automatic string saving and has secondary languages published. If these features are enabled, you should treat the situation with high priority. Look for official plugin updates that address this issue and consult with your technical team to ensure that sensitive data like password reset links cannot be stored or accessed via translation tables.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.