A WordPress plugin that translates your site into other languages was also translating administrator password reset emails, and then filing them in a database table that any visitor could read back. That is the short version of a Wordfence advisory published on August 25 covering TranslatePress, a multilingual plugin installed on more than 400,000 sites. The flaw is tracked as CVE-2026-19632 and rated 9.8 out of 10. An attacker who knows nothing but an administrator's username or email address could take the account, and with it the site.
Why a reset email became a translated string
The bug is not one mistake but two features meeting. TranslatePress hooks into the function WordPress uses to send mail, switches to the recipient's preferred language, and runs the subject and body through its translation pipeline. It also has automatic string saving turned on by default, which means anything passing through that pipeline is stored as a translatable string in the dictionary table for that language.
So when an administrator whose profile language is set to one of the site's published secondary languages asks for a password reset, the reset email goes through translation, and the entire reset URL, including the plaintext key that authorises the reset, is written into the dictionary table.
A public endpoint that reads the dictionary back
The second half is an AJAX action, trp_get_translations_regular, that any unauthenticated visitor can call. It accepts a list of string IDs and returns the matching dictionary rows. Chain the two and the attack is almost embarrassingly direct: trigger a password reset for a known administrator, then walk the secondary-language dictionary through the public endpoint until the reset URL comes back in plaintext. Set a new password, log in, and the site is yours. From there, as with any administrator takeover, an attacker can add more administrator accounts, install a backdoored plugin or theme, or quietly pull data out.
Not every site is exposed
Wordfence is explicit about the limits, and they matter. The reset link only leaks when the targeted administrator's own profile language is set to a published secondary language. If that administrator is left on the site's default language, the reset email never goes through the secondary-language pipeline and never lands in a dictionary table the public endpoint can read. Automatic string saving, which is the default setting, also has to be enabled. That narrows the exposed population well below 400,000, but it is not a condition most site owners can confirm at a glance, and a multilingual site whose administrators work in one of the secondary languages is exactly the case where it holds.
Update to 3.3.2, and turn on a second factor
Every version up to and including 3.3.1 is affected. Cozmoslabs, the plugin's developer, shipped the fixed 3.3.2 on August 13, the day after Wordfence disclosed the report, which is about as fast as this process goes. Updating is the fix, and there is no configuration workaround worth relying on instead.
The researcher momopon1415 reported the flaw through Wordfence's bug bounty program on August 11 and was paid $975. Wordfence pushed a firewall rule to its paying customers on August 13, with free users scheduled to receive the same rule on September 12, a gap worth knowing about if you are leaning on the free tier rather than the update.
It is also a decent argument for two-factor authentication on administrator accounts. A password reset flaw hands an attacker a password, and a password on its own is not enough to log in when a second factor is required. That does not remove the need to patch, but it is the sort of control that turns a critical takeover bug into a failed login attempt. This is the third unauthenticated takeover path through a widely deployed WordPress plugin we have covered this month, after a file upload flaw in Forminator and an authentication bypass triggered by a long username.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.