TranslatePress CVE-2026-18512

Exploitation requires all of the following: (1) TranslatePress version 3.2.6 or earlier is installed and active on the target WordPress site; (2) the attacker holds a valid subscriber-level (or higher) WordPress account - subscriber is the minimum role; (3) the attacker can submit a comment that is subsequently approved by a site moderator, causing the comment body to appear as a string in the Translation Editor's Strings Dropdown; (4) a higher-privileged user (editor or administrator) must open the Translation Editor and access the Strings Dropdown after the malicious comment has been approved and indexed. Exploitation is limited by the requirement for authenticated subscriber access and the necessary administrator interaction with the translation editor after comment approval - anonymous unauthenticated exploitation is not possible. Sites that disable open user registration, require manual subscriber approval, or do not actively use the translation editor interface face materially reduced exposure.

The CVSS 3.1 score of 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N accurately reflects the mechanics but understates the operational impact: the S:C (Scope Change) metric is the critical signal, indicating the attacker's subscriber-level payload crosses a security boundary to execute in the context of higher-privileged users who interact with the translation editor. This makes the practical impact closer to a privilege-escalation-to-admin scenario than a typical medium-severity stored XSS. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from that signal. The CVE is not listed in CISA KEV, confirming no documented active exploitation at time of analysis. However, Wordfence's disclosure includes precise source file line numbers across editor.vue and utils.js, which materially lowers the bar for independent exploit development and warrants treating this as a higher operational priority than the medium CVSS score alone suggests. The attack complexity is genuinely low: subscriber registration on many WordPress sites is open by default, and comment approval is routine editorial workflow.

An attacker registers a subscriber account on the target WordPress site and submits a comment containing a crafted JavaScript payload such as a script tag or attribute-based event handler. Once a moderator approves the comment and it is indexed as a translation string, any administrator or editor who opens the Translation Editor's Strings Dropdown will have the attacker's script execute in their browser session, allowing the attacker to exfiltrate the admin's session cookie and take over the WordPress admin panel. No public POC exploit code has been identified, but Wordfence's source-level disclosure with specific line references substantially lowers the effort required to construct one independently.