EUVD-2026-65174
GHSA-6pq2-4w9g-5v25
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running TranslatePress ≤3.3.2
-
DeliverySend crafted unauthenticated HTTP request
-
ExploitTrigger incorrect privilege assignment
-
ExecutionGain elevated site privileges
-
ImpactManipulate content, data, or accounts
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | The affected component must be a WordPress site running TranslatePress version 3.3.2 or earlier, reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required - remote unauthenticated exploitation against affected TranslatePress installations, with no user interaction and low complexity. The primary limiting factor is version: sites already on a release above 3.3.2 are not affected. The exact vulnerable feature, endpoint, or configuration prerequisite is not specified in the available data, so whether any non-default plugin setting narrows exploitability is unconfirmed and should be verified against the Patchstack advisory. |
| Impact | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes the theoretical worst case: network-reachable, low complexity, no privileges, no user interaction, with high confidentiality, integrity and availability impact - consistent with unauthenticated privilege escalation on a public-facing WordPress site. However, several corroborating signals are missing: no EPSS score was provided, so real-world exploitation probability cannot be quantified; there is no KEV listing and no POC indicator, so exploitation is not confirmed to be occurring. The single Patchstack reference is a vulnerability database entry rather than a detailed technical write-up in this dataset. Net: treat as a high-priority patch candidate given the plugin's WordPress footprint and unauthenticated network vector, but note that active-exploitation and probability data are absent rather than confirmed low. |
| Exploit ScenarioDerived | An attacker identifies a public WordPress site running a vulnerable TranslatePress version (≤ 3.3.2) and sends a crafted unauthenticated request to the plugin's affected handler to invoke a privileged action or grant themselves elevated capabilities. With low attack complexity and no authentication or user interaction required per the CVSS vector, the attacker escalates privileges and can then manipulate site content, data, or accounts. No public POC is identified at time of analysis, so this scenario is derived from the vulnerability class and CVSS vector rather than a demonstrated exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Unauthenticated privilege escalation in the TranslatePress multilingual plugin for WordPress (all versions up to and including 3.3.2) allows a remote, unauthenticated attacker to gain elevated privileges within the site, per a Patchstack advisory. The flaw is classified as incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can escalate to a high-impact role without authentication or user interaction. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified in the available data, so the specific fixed release cannot be cited here; administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/translatepress-multilingual/vulnerability/wordpress-translatepress-plugin-3-3-2-privilege-escalation-vulnerability) and the Cozmoslabs changelog for a release above 3.3.2 and upgrade to it immediately once confirmed. Until a fixed version is verified and applied, compensating controls include placing the site behind a WAF with virtual-patching rules for this CVE (Patchstack or comparable WordPress WAFs typically ship such rules), restricting access to the plugin's AJAX/REST endpoints, and temporarily deactivating the TranslatePress plugin if the multilingual functionality can be paused - noting that deactivation will disable translated front-end content and may affect SEO and user-facing language switching. Monitor user and role tables for unexpected new administrator or elevated-privilege accounts as a detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TranslatePress (vendor Cozmoslabs, CPE cpe:2.3:a:cozmoslabs:translatepress) is a widely used WordPress plugin that provides visual, front-end translation and multilingual site management. The root-cause class is CWE-266 (Incorrect Privilege Assignment), meaning the plugin assigns a privilege or capability to an actor who should not receive it - typically an AJAX action, REST endpoint, or role/capability check that fails to properly gate a privileged operation. Because WordPress plugins run inside the CMS request lifecycle, a missing or flawed capability check in a plugin handler can let an unauthenticated request perform actions reserved for administrators.
Know when Translatepress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated privilege escalation over the network with no user interaction, giving AV:N/AC:L/PR:N/UI:N and high C/I/A from full site takeover.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.
Executive ViewAI
TranslatePress multilingual plugin for WordPress (versions through 3.3.2) exposes all WordPress sites using it to unauthenticated administrative takeover due to a critical privilege escalation flaw (CVSS 9.8); while no public exploit has been identified at this time, the vulnerability requires immediate remediation. Any website relying on TranslatePress is at risk of unauthorized access to site content, customer data, and system configuration. No vendor patch currently exists, requiring urgent action to disable the plugin or implement restrictive access controls.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Disable or remove the TranslatePress plugin from all production WordPress installations; (2) If disabling is operationally infeasible, restrict WordPress administrative panel access to trusted IP ranges using Web Application Firewall or server-level network controls; (3) Deploy WAF rules to monitor for privilege escalation attempts if your provider has published signatures for CVE-2026-78267; (4) Increase logging and alerting on WordPress authentication events and user privilege changes; (5) Monitor TranslatePress GitHub repository and Patchstack security advisories daily and apply all patches immediately upon availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Translatepress
View allThe Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. Rated hi
The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. Rat
Stored cross-site scripting in the Cozmoslabs TranslatePress WordPress plugin (versions up to and including 3.3.6) lets
Unauthenticated XSS in the TranslatePress WordPress plugin versions 3.3.2 and earlier allows remote, unauthenticated att
Exploit-DB