Description

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T05:18:06.810Z",
  "pubdate": "2026-08-26T05:18:06.810Z",
  "executiveSummary": "The TranslatePress – Translate Multilingual sites with AI Translation plugin is affected by a Sensitive Information Exposure vulnerability originating from the 'trp_get_translations_regular' AJAX action.\nThis vulnerability allows unauthenticated attackers to exfiltrate sensitive data, including raw administrator password-reset URLs, by querying the plugin's translation dictionary table.\nThe issue impacts all versions up to and including 3.3.1. Successful exploitation results in the compromise of administrator credentials and potential full account takeover.\nThe flaw is triggered when 'automatic string saving' is enabled—the default configuration—and an administrator's profile locale is set to a published secondary language, causing sensitive URL strings to be indexed by the translation system.\nBecause the 'trp_get_translations_regular' action lacks proper access controls, it is publicly accessible, enabling remote, unauthenticated attackers to harvest sensitive authentication tokens without prior interaction.",
  "technicalDetails": "The vulnerability resides in the 'trp_get_translations_regular' AJAX action within the TranslatePress plugin. This function is designed to return translation strings from the database to the client-side for dynamic content localization.\nThe root cause is an improper lack of authentication and authorization checks on the AJAX endpoint, combined with an overly permissive data retrieval mechanism that includes internal system strings stored in the translation dictionary table.\nWhen 'automatic string saving' is active, the plugin captures strings rendered on a page and saves them to the 'trp_dictionary' table. If an administrator triggers a password reset while their interface locale matches a configured secondary language, the password-reset URL—containing the plaintext reset key and relevant login parameters—is dynamically rendered on the page.\nTranslatePress inadvertently intercepts this URL and persists it within the translation dictionary as a translatable string associated with the target locale.\nAn attacker can exploit this by invoking the 'trp_get_translations_regular' AJAX action. Because the endpoint does not verify the requester's identity, an unauthenticated user can request the full dictionary or specific entries. Upon receiving the dictionary data, the attacker can parse the JSON response to identify the stored password-reset URL.\nThe attack flow is as follows: 1) The attacker identifies a target site using TranslatePress with automatic string saving enabled. 2) The attacker waits for or triggers a scenario where an administrator accesses a password-reset flow while using a secondary language locale. 3) The plugin stores the URL in the dictionary table. 4) The attacker sends a crafted request to 'trp_get_translations_regular'. 5) The server returns the dictionary content, including the reset URL. 6) The attacker uses the exfiltrated URL to reset the administrator password and gain unauthorized administrative access.\nThe impact is critical, as it facilitates a total bypass of the authentication mechanism, granting the attacker complete control over the WordPress administrative environment."
}