A critical vulnerability in the TranslatePress plugin for WordPress, identified as CVE-2026-19632, was actively exploited in the wild at least one day before its public disclosure on August 26, 2026. The flaw, which carries a CVSS score of 9.8, allows unauthenticated attackers to gain full administrator account takeover.
The vulnerability is a sensitive information exposure issue found in all versions of the plugin up to and including 3.3.1. Specifically, it resides within the `trp_get_translations_regular` AJAX action. This allows attackers to extract the raw administrator password-reset URL, which includes the plaintext reset key and login parameters stored in the translation dictionary table.
Successful exploitation of this vulnerability is contingent on two specific conditions: automatic string saving must be enabled, which is the default setting for the plugin, and the target administrator's profile locale must be set to a published secondary language. When these conditions are met, an attacker can leverage the exposed information to reset the administrator's password and take control of the account.
Evidence of exploitation was first reported on August 25, 2026, a day prior to the CVE's official publication. Public reports of exploitation continued to emerge, with further sightings noted as late as September 2, 2026. While the vulnerability is listed as exploited by a commercial research catalogue, it has not been included in the CISA KEV (Known Exploited Vulnerabilities) catalog or the ENISA (European Union Agency for Cybersecurity) EUVD.
