External risk intelligence

TranslatePress Unauthenticated Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-78267

TranslatePress is a WordPress plugin designed to make websites multilingual. By nature, it functions as a public-facing web component integrated into the site's front end to serve translated content to visitors, making the vulnerable code path commonly reachable over the public internet in standard website deployments.

Privilege Escalation

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses an unauthenticated privilege escalation vulnerability in a widely used website translation plugin. The issue allows unauthorized individuals to potentially gain elevated access to systems running the affected software, which could have significant security implications. The primary concern is to confirm if your organization utilizes this specific plugin and, if so, to understand its potential exposure.

Unauthenticated users can gain higher system access.
Affects website translation functionality.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could leverage this vulnerability to gain administrative privileges on a WordPress site. This is possible because the TranslatePress plugin, when running on a public-facing website, exposes a function that improperly handles user input. By sending specifically crafted requests, an attacker could bypass authentication and execute actions with elevated permissions, potentially leading to full site compromise.

No authentication required.
Manipulate plugin functionality.
Gain administrative access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to escalate their privileges on a website using TranslatePress, potentially leading to unauthorized control over the website's content and functionality. This is possible when the plugin is installed and configured in a way that exposes the vulnerable code path to the public internet.

Website content and administrative access.
Through network requests to the affected site.
Complete compromise of the website.

Operational Fix

Recommended remediation, mitigation, and detection steps

Unauthenticated privilege escalation in TranslatePress affects all versions prior to 3.3.3. Given its nature as a public-facing WordPress plugin, platform or web administration teams are likely responsible for its management. The first practical step is to identify all instances of TranslatePress, confirm their reachability and business criticality, and then assign ownership for remediation planning based on risk.

Platform or web admin teams own.
Confirm TranslatePress instances exist.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is TranslatePress?

TranslatePress is a WordPress plugin used to translate website content into multiple languages. It functions as a public-facing component that sits on the front end of a site, allowing visitors to view pages in their preferred language. Because it integrates directly into the site's interface to handle these requests, it becomes a core part of the web server's environment.

What does CWE-266 mean for CVE-2026-78267?

This vulnerability is classified as CWE-266, which refers to Incorrect Privilege Assignment. In the context of CVE-2026-78267, this means the software fails to correctly verify the authority of a user before granting them elevated rights. Essentially, the plugin mistakenly treats an unauthenticated visitor as an authorized user, allowing them to perform actions reserved for administrators.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specifically crafted network requests to the website. Because the plugin improperly handles user input, these requests bypass standard authentication checks. Note that this flaw is not triggered by normal visitor traffic or legitimate translation requests; it requires intentional manipulation of input aimed at exploiting the underlying privilege management failure.

Is my site at risk according to Halo Surface Signal?

Yes, if you use this plugin, your risk is considered high. Halo Surface Signal identifies this as an external-facing issue because TranslatePress is inherently designed to be public-facing. Since the vulnerable code path is typically reachable over the internet in standard WordPress deployments, it provides a direct vector for an attacker to reach your system.

What should I do if I run TranslatePress?

Your first step is to create an inventory of all WordPress sites where TranslatePress is installed. Once you have a list of active instances, evaluate their business criticality and internet exposure. Coordinate with your web administration team to plan for updates, as the vulnerability exists in all versions up to and including 3.3.2.

References

patchstack.com/database/wordpress/plugin/translatepress-multilingual…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.