Description

Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-24T22:17:20.670Z",
  "pubdate": "2026-08-24T22:17:20.670Z",
  "executiveSummary": "An unauthenticated privilege escalation vulnerability affects the TranslatePress plugin in versions 3.3.2 and below. This security flaw allows unauthenticated remote attackers to elevate their privileges within the targeted WordPress installation, potentially granting administrative access or unauthorized capabilities. The vulnerability arises from improper handling of user roles or authorization checks during specific request processing within the affected product. The risk implications are severe, as successful exploitation enables threat actors to completely compromise the underlying content management system without requiring prior credentials or interaction. Exploitation requirements are minimal, relying solely on network accessibility to the vulnerable WordPress instance running the affected plugin versions. Mitigation necessitates immediate software updates or removal of the vulnerable component to prevent unauthorized privilege assignment and potential system takeover.",
  "technicalDetails": "The vulnerability resides in the TranslatePress plugin for WordPress, specifically affecting versions 3.3.2 and prior. The root cause stems from an absence of adequate authentication and authorization checks within specific request handling routines, allowing external callers to manipulate user roles or invoke privileged actions. Network exposure is high, as the vulnerable endpoints are accessible over HTTP and HTTPS to any unauthenticated remote attacker visiting the target website. The attack flow begins when an unauthenticated actor sends a specially crafted HTTP request targeting the vulnerable component within TranslatePress. Because the codebase fails to properly validate the session state or verify whether the requesting user possesses administrative privileges, the application processes the incoming payload as a legitimate administrative action. Consequently, the payload behavior triggers unauthorized modifications to user privilege levels, effectively promoting the unauthenticated visitor to an elevated role such as administrator. The post-exploitation impact is critical, providing the attacker with full administrative control over the WordPress site, enabling malicious code execution via theme or plugin editing, data exfiltration, defacement, or the creation of persistent backdoor administrative accounts. The lack of strict capability checks and missing nonce validations in the vulnerable functions facilitate this bypass of security controls, allowing unauthorized state-changing operations to be executed remotely."
}