A TranslatePress Bug Exposed Admin Password Reset Links on 400,000 WordPress Sites

A critical vulnerability in TranslatePress, a WordPress translation plugin installed on more than 400,000 active sites, let unauthenticated attackers retrieve administrator password reset links and take over affected sites, according to a disclosure published by security firm Wordfence on August 25, 2026.

Wordfence tracks the flaw as CVE-2026-19632 and assigned it a CVSS score of 9.8, near the top of the critical range. The company says the bug made it possible for an unauthenticated attacker to “obtain an administrator’s password reset link, reset the account’s password, and log in as that administrator, resulting in complete site takeover.”

A Reset Link Captured by the Translation Engine

According to Wordfence, the flaw traces back to how TranslatePress handles multilingual content. The plugin’s translation system captured outgoing password reset emails and stored their text, including the reset link itself, inside its secondary-language string dictionaries. A public AJAX action built for managing those translation strings could then be used to retrieve the stored reset URLs, plaintext reset key included.

Wordfence says the exposure only applied when the targeted administrator’s profile language was set to a published secondary language, the same condition that would route an account’s outgoing email through the plugin’s translation pipeline described above. On a multilingual WordPress site, having at least one administrator account configured that way is not unusual.

Once an attacker had a valid reset link in hand, exploiting it required no special access: they could reset the administrator’s password directly, log in, and take full control of the site, including its files, database, and every other account on it.

A Two-Day Fix, a Two-Week Wait to Disclose

Wordfence credits the discovery to a researcher using the handle momopon1415, who reported the issue through Wordfence’s Bug Bounty Program on August 11, 2026, and earned a $975 bounty for the submission. TranslatePress developer Cozmoslabs shipped a fix in version 3.3.2, released August 13, 2026, just two days after the report. Wordfence then held its public writeup for close to two weeks, giving site owners a window to update before the technical details became widely known.

The plugin’s own changelog corroborates the timeline: the entry for version 3.3.2 credits a fix for a “security issue regarding sensitive information exposure” to “momopon1415 and the Wordfence team.” Cozmoslabs has since shipped two further updates, 3.3.3 and 3.3.4, each patching separate, unrelated issues credited to other researchers.

What TranslatePress Users Should Do

Any site still running TranslatePress 3.3.1 or earlier is exposed to CVE-2026-19632. WordPress.org lists the plugin’s current version as 3.3.4, and site owners who have not updated since before August 13 should do so immediately rather than assume automatic updates already applied the fix. Because the flaw could be exploited without authentication, sites that were running a vulnerable version during that window should also reset administrator passwords and review recent admin activity as a precaution.

TranslatePress is not the only Cozmoslabs plugin to receive a critical, unauthenticated account-takeover disclosure this year. Wordfence reported a similar auto-login flaw in the company’s User Profile Builder plugin earlier this month, which exposed roughly 40,000 sites before it was patched. Neither bug appears to share a root cause with the other, but together they are a reminder that features built to handle dynamic content, translation strings in this case, an auto-login mechanism in the other, can end up capturing sensitive data they were never designed to protect.