CVE-2026-19632 is a critical vulnerability in TranslatePress, the multilingual translation plugin running on more than 400,000 WordPress sites, that can expose an administrator’s password-reset link to any visitor. It’s triggered by a specific combination of settings — automatic string translation enabled, and the admin’s profile language set to a published secondary language — not by every install running the plugin. The fix is to update to version 3.3.4 or later and check whether your site matches that configuration.
How This Actually Works
TranslatePress automatically saves strings it encounters for translation into its own database table, so they can be edited later. When an administrator requests a password reset while their account’s language is set to a secondary, published language, the reset link itself — including the plaintext reset key — can get captured by that same auto-translation process and stored in the translation dictionary. Since translated strings are part of what TranslatePress displays to visitors switching languages on the front end, that reset link becomes readable by anyone who knows where to look, without ever needing to log in.
From there, an attacker with the reset key can complete the password reset flow for that administrator account directly — full account takeover, no phishing or credential guessing required.
Are You Actually Affected?
| Condition | Increases risk? |
|---|---|
| Running TranslatePress 3.3.1 or earlier | Yes — update regardless of the rest of this table |
| “Automatic Translation” / auto string-saving enabled | Yes |
| Any administrator’s profile language set to a secondary, published language | Yes |
| Site only ever used in its single default language | Lower risk, but update anyway — configurations change |
What to Do Right Now
- Update TranslatePress to 3.3.4 or later. The vulnerability was first patched in 3.3.2, but 3.3.4 is the current recommended version — don’t stop at the minimum patched release.
- Check every administrator’s profile language setting. If any admin’s language is set to something other than the site’s primary language, that’s the specific condition this vulnerability needs.
- Rotate admin passwords after updating if you can’t rule out that a reset link was ever exposed while you were on a vulnerable version.
- Review recently added admin accounts and installed plugins/themes for anything you don’t recognize, in case the site was already compromised before you patched.
If You Find Signs of Compromise
An unfamiliar admin account, a plugin or theme you didn’t install, or unexpected site content are all signs this may already have been exploited rather than just a theoretical risk. We walk through the actual recovery steps — not just “restore a backup and hope” — in WordPress Site Hacked? Here’s the Recovery Checklist We Actually Use. If you’d like a second set of eyes on a multilingual site’s configuration, get in touch and we can take a look.
Frequently Asked Questions
Is my site vulnerable if I don’t use TranslatePress?
No, CVE-2026-19632 is specific to the TranslatePress plugin. If you don’t have it installed, this particular vulnerability doesn’t apply to your site.
Do I need multiple languages actually published for this to be a risk?
Yes — the vulnerability specifically requires an administrator’s profile language to be set to a secondary language that’s actually published on the site, combined with automatic string translation being turned on.
Is updating to the patched version enough, or do I need to do more?
Updating closes the vulnerability going forward, but it doesn’t undo any exposure that already happened. If your site matched the risky configuration before you updated, rotate admin passwords and check for unfamiliar accounts or content as a precaution.
Featured image: original illustration.