EUVD-2026-65174
GHSA-6pq2-4w9g-5v25
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated privilege escalation over the network with no user interaction, giving AV:N/AC:L/PR:N/UI:N and high C/I/A from full site takeover.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.
AnalysisAI
Unauthenticated privilege escalation in the TranslatePress multilingual plugin for WordPress (all versions up to and including 3.3.2) allows a remote, unauthenticated attacker to gain elevated privileges within the site, per a Patchstack advisory. The flaw is classified as incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can escalate to a high-impact role without authentication or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The affected component must be a WordPress site running TranslatePress version 3.3.2 or earlier, reachable over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes the theoretical worst case: network-reachable, low complexity, no privileges, no user interaction, with high confidentiality, integrity and availability impact - consistent with unauthenticated privilege escalation on a public-facing WordPress site. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a public WordPress site running a vulnerable TranslatePress version (≤ 3.3.2) and sends a crafted unauthenticated request to the plugin's affected handler to invoke a privileged action or grant themselves elevated capabilities. With low attack complexity and no authentication or user interaction required per the CVSS vector, the attacker escalates privileges and can then manipulate site content, data, or accounts. … |
| Remediation | No vendor-released patch version is identified in the available data, so the specific fixed release cannot be cited here; administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/translatepress-multilingual/vulnerability/wordpress-translatepress-plugin-3-3-2-privilege-escalation-vulnerability) and the Cozmoslabs changelog for a release above 3.3.2 and upgrade to it immediately once confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, disable or remove the TranslatePress plugin from all affected WordPress installations; if multilingual content delivery is operationally critical, isolate affected sites to a restricted network and implement IP whitelisting for all administrative access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Translatepress
View allThe Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. Rated hi
The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. Rat
Unauthenticated XSS in the TranslatePress WordPress plugin versions 3.3.2 and earlier allows remote, unauthenticated att
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today