CVE-2026-19632 is a critical vulnerability in the TranslatePress plugin caused by a weak password recovery mechanism. The flaw resides in the trp_get_translations_regular AJAX action, which processes both authenticated and unauthenticated requests without properly restricting access to sensitive data.

An attacker can query this AJAX endpoint directly to retrieve translation strings that contain the site administrator's raw password-reset URL and plaintext reset key. Exploitation requires the plugin's automatic string-saving feature to be enabled, which is the default setting, and the administrator's account locale to be set to a secondary published language on the site — a combination plausible on any actively maintained multilingual site.

The following version(s) are affected:

TranslatePress versions up to and including 3.3.1 – (Affected)
TranslatePress 3.3.2 and later – (Not affected, patched)

Site administrators should confirm their installed TranslatePress version from the WordPress admin dashboard and upgrade regardless of whether the specific precondition combination is currently in place, since site configuration can change over time.

This flaw requires no authentication and can be triggered directly against the vulnerable AJAX action on any affected site.

Step 1 - Query the Vulnerable AJAX Endpoint

An attacker sends an unauthenticated request directly to the trp_get_translations_regular AJAX action, which does not properly restrict which translation strings it returns.

Step 2 - Extract the Administrator's Password-Reset Details

If the site's automatic string-saving feature is enabled and the administrator account's locale is set to a secondary language, the response includes the administrator's raw password-reset URL and plaintext reset key.

Attack Vectors

• Direct, unauthenticated network requests to the AJAX endpoint — no credentials, privileges, or user interaction required.
• Any multilingual WordPress site running TranslatePress with default string-saving settings.

Potential Impact

• Obtain the administrator's password-reset URL and reset key directly, without needing to trigger or intercept a password-reset email.
• Use the reset key to take over the administrator account and gain full control of the WordPress site.

CERTVU recommends the following:

1. Update TranslatePress immediately

   Upgrade to TranslatePress 3.3.2 or later without delay.

2. Reset administrator credentials as a precaution

   Change the WordPress administrator password and invalidate any outstanding password-reset requests, particularly on sites where the automatic string-saving feature has been enabled.

3. Review administrator account activity

   Check login history and account activity for administrator accounts for any sign of unauthorised access before the update was applied.

4. Audit the estate for the affected product

   Identify every WordPress site in the organisation running TranslatePress and confirm each has been upgraded to 3.3.2 or later.

5. Monitor Wordfence's and TranslatePress's security advisories for further updates

   Keep track of any follow-up guidance or additional patches issued for this vulnerability.

For further detail, see Ionix Threat Center: CVE-2026-19632.