EUVD-2026-66230
GHSA-p6fq-w74v-62gm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network, unauthenticated, no UI, but the required non-default secondary-language admin locale and a live reset URL are attacker-independent preconditions, so AC:H; full account takeover gives C/I/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL - including the plaintext reset key and login parameters stored in the translation dictionary table - enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.
Articles & Coverage 1
AnalysisAI
Unauthenticated administrator account takeover affects the TranslatePress - Translate Multilingual sites with AI Translation plugin for WordPress in all versions through 3.3.1, where the 'trp_get_translations_regular' AJAX action returns raw translation-dictionary entries without access control. Because an administrator's password-reset URL can be persisted into the secondary-language dictionary as a translatable string, an unauthenticated attacker can read the plaintext reset key and login parameters and seize the admin account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete conditions drawn from the description: (1) automatic string saving must be enabled - this is the default setting; (2) the targeted administrator's WordPress profile locale must be set to a published secondary language configured in TranslatePress, which causes the password-reset URL to be persisted into that language's dictionary table; and (3) a valid, not-yet-consumed administrator password-reset URL must exist in the dictionary at the time of the request. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to genuine high priority but with an important reliability caveat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker triggers (or waits for) an administrator password reset on a multilingual WordPress site where that admin's locale is a secondary language; the reset link gets stored as a translatable string. The attacker then sends an unauthenticated 'trp_get_translations_regular' AJAX request to admin-ajax.php, reads the returned dictionary entry containing the plaintext reset key and login, and completes the password reset to take over the admin account. … |
| Remediation | Upgrade TranslatePress to the first release above 3.3.1 that incorporates the fix in WordPress plugin changeset 3645229 (https://plugins.trac.wordpress.org/changeset/3645229) - an upstream fix is available via that changeset, but a specific tagged patched version is not independently confirmed from the provided data, so verify the current version against the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/4f4ebf09-b089-4118-a0ee-399243253f9c?source=cve) before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress installations using TranslatePress through 3.3.1 and disable or remove the plugin immediately; reset all administrator account passwords and review recent login logs for unauthorized access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Reflected XSS in the TranslatePress WordPress plugin (versions ≤ 3.2.5) allows unauthenticated attackers to inject and e
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (versions up to and including 3.2.5) allows unauthent
Stored XSS in the TranslatePress WordPress plugin (all versions ≤3.2.6) enables unauthenticated attackers to inject pers
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (all versions through 3.3.3) allows unauthenticated a
Stored Cross-Site Scripting in TranslatePress (WordPress plugin by cozmoslabs) versions through 3.2.6 allows authenticat
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today