Researchers have uncovered a critical vulnerability with a CVSS score of 9.8 in the TranslatePress WordPress plugin, with 400,000 active installations, that could allow unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover.
More info here: https://www.wordfence.com/blog/2026/08/400000-wordpress-sites-affected-by-account-takeover-vulnerability-in-translatepress-wordpress-plugin/
Dan Moore, Sr. Director CIAM Strategy at cybersecurity company FusionAuth, provided the following comments:
TranslatePresss (CVE-2026-19632)
An attacker can gain admin access to multi-language WordPress sites by retrieving a plaintext admin password reset link and key via an unprotected API. This shows how combining two unrelated APIs can have unexpected and unfortunate security implications. In addition, trp_get_translations_regular handles translations for all types of users, including admin, logged in and anonymous users. Separating these and ensuring all API endpoints that handle known user data have proper authentication and access controls is critical of security.
“Forminator (CVE-2026-15748)
By allowing anyone to manipulate form submissions to set their own upload rules for field names and data handling, Forminator lets attackers run their code on your site. This is a case where the cracks in several systems were chained together:
- Forminators uploading accepting user content
- The difference in the handling between WordPress’s and Forminator’s blocklists
- The lack of .htaccess protects for certain configurations
Complex systems interact in unexpected ways that attackers exploit. I mean, no single piece of this is obviously catastrophic on its own. That’s kind of the point. And that’s exactly what makes this class of vulnerability hard to patch your way out of.
Given that I am a WordPress user, I am going to check my site to make sure that I am protected. You should do the same.
Related
This entry was posted on August 27, 2026 at 8:15 am and is filed under Commentary with tags WordPress. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
400,000 WordPress Sites Impacted by Account Takeover Vuln in TranslatePress Plugin
Researchers have uncovered a critical vulnerability with a CVSS score of 9.8 in the TranslatePress WordPress plugin, with 400,000 active installations, that could allow unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover.
More info here: https://www.wordfence.com/blog/2026/08/400000-wordpress-sites-affected-by-account-takeover-vulnerability-in-translatepress-wordpress-plugin/
Dan Moore, Sr. Director CIAM Strategy at cybersecurity company FusionAuth, provided the following comments:
TranslatePresss (CVE-2026-19632)
An attacker can gain admin access to multi-language WordPress sites by retrieving a plaintext admin password reset link and key via an unprotected API. This shows how combining two unrelated APIs can have unexpected and unfortunate security implications. In addition, trp_get_translations_regular handles translations for all types of users, including admin, logged in and anonymous users. Separating these and ensuring all API endpoints that handle known user data have proper authentication and access controls is critical of security.
“Forminator (CVE-2026-15748)
By allowing anyone to manipulate form submissions to set their own upload rules for field names and data handling, Forminator lets attackers run their code on your site. This is a case where the cracks in several systems were chained together:
Complex systems interact in unexpected ways that attackers exploit. I mean, no single piece of this is obviously catastrophic on its own. That’s kind of the point. And that’s exactly what makes this class of vulnerability hard to patch your way out of.
Given that I am a WordPress user, I am going to check my site to make sure that I am protected. You should do the same.
Share this:
Like this:
Related
This entry was posted on August 27, 2026 at 8:15 am and is filed under Commentary with tags WordPress. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.