A critical flaw in the TranslatePress WordPress plugin — rated CVSS 9.8 and tracked as CVE-2026-19632 — allows an unauthenticated attacker to steal the raw password-reset URL for a site administrator, including the plaintext reset key and login parameters, without ever logging in. Once the attacker has that URL they can set a new password and take full control of the site. The vulnerability is present in all TranslatePress versions up to and including 3.3.1, but only activates when two specific settings are both enabled: automatic string saving is turned on, and the target administrator’s profile locale is set to a published secondary language. Wordfence, which discovered the flaw, says approximately 400,000 WordPress sites are running an affected version.
The fix is available in TranslatePress 3.3.2. Site owners running a vulnerable configuration should treat this as an emergency update rather than a routine patch — an attacker with admin access can install malicious plugins, steal visitor data, redirect traffic, or turn the site into a phishing host with no further authentication needed.
How to check if you’re affected
Affected versions include TranslatePress 3.3.1 and earlier with automatic string saving enabled and a secondary-language admin profile locale. In your WordPress dashboard, go to Plugins → Installed Plugins, locate TranslatePress, and check the version shown below the plugin name. If the installed version is older than 3.3.2, update immediately. You can also check your TranslatePress settings to confirm whether automatic string saving is active.