Unauthenticated admin password-reset key disclosure in TranslatePress WordPress plugin (CVE-2026-19632)
The CVE was added to VulnCheck's known-exploited catalog with two public exploits in XDB, so unpatched sites running the default configuration can have their administrator accounts taken over by unauthenticated attackers using off-the-shelf tooling.
TranslatePress versions up to and including 3.3.1 expose the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary — via the unauthenticated 'trp_get_translations_regular' AJAX action when automatic string saving (the default) is enabled. An attacker can trigger and harvest a reset link to take over the administrator account without any credentials.
Affected: TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.1
How to Test
Confirm the installed plugin version — anything at or below 3.3.1 with automatic string saving enabled (the default) is exploitable; review web server logs for unauthenticated requests invoking the 'trp_get_translations_regular' AJAX action and audit administrator accounts for unexpected password resets or new sessions.
How to Patch
Update TranslatePress to a version later than 3.3.1; until updated, disable automatic string saving in the plugin settings, which the vulnerability requires, and rotate administrator passwords on any site where the vulnerable action was reachable.