CVE-2026-19632

CriticalCVSS 9.8/10Last modified Aug 26, 2026

Description

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-640

Affected software

No affected versions have been published.

Timeline

Published: Aug 26, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-196338.8PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain CVE-2026-196346.4PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing CVE-2026-196358.8A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could a CVE-2026-196365.3An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a securi CVE-2026-196394.3An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings o CVE-2026-19645.3A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endp CVE-2026-196404.2On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive inco CVE-2026-196415.3On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authenticat CVE-2026-196425.9An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a CVE-2026-196435.3An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticat CVE-2026-196445.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu CVE-2026-196456.5IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computatio