TranslatePress CVE-2026-19632

Exploitation requires three concrete conditions drawn from the description: (1) automatic string saving must be enabled - this is the default setting; (2) the targeted administrator's WordPress profile locale must be set to a published secondary language configured in TranslatePress, which causes the password-reset URL to be persisted into that language's dictionary table; and (3) a valid, not-yet-consumed administrator password-reset URL must exist in the dictionary at the time of the request. The limiting factors are significant: sites where all admins use the default/primary language, sites without a published secondary language, or sites with automatic string saving disabled are not exploitable, and the reset key must still be valid/unused. Authentication is not required (CVSS PR:N) and no user interaction is needed on the victim side beyond a reset link having been generated.

The signals point to genuine high priority but with an important reliability caveat. CVSS 3.1 is scored 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), i.e. remote, unauthenticated, low-complexity with full impact, and the outcome - capture of an admin password-reset key - leads directly to complete site compromise. However, exploitation is gated by two real preconditions: automatic string saving must be enabled (this is the default) and the targeted administrator's profile locale must be set to a published secondary language (not the default), and there must be a live/valid reset URL sitting in the dictionary. That non-default locale requirement is attacker-independent, which in my view raises real-world attack complexity above the AC:L the NVD vector claims. No EPSS score, KEV entry, or public POC was provided, so there is no evidence of active exploitation yet - the risk is currently theoretical-but-serious rather than mass-exploited. Given the trivial mechanics once conditions are met and the total-takeover payoff, any operator running a vulnerable version with multilingual admin accounts - even a mid-sized municipal IT team - should treat patching as urgent, while recognizing that sites without secondary-language admin locales are unlikely to be exploitable.

An attacker triggers (or waits for) an administrator password reset on a multilingual WordPress site where that admin's locale is a secondary language; the reset link gets stored as a translatable string. The attacker then sends an unauthenticated 'trp_get_translations_regular' AJAX request to admin-ajax.php, reads the returned dictionary entry containing the plaintext reset key and login, and completes the password reset to take over the admin account. No public POC was provided, but the low-complexity network-reachable endpoint makes weaponization straightforward once conditions are met.