Filtered by tag: account takeover × Clear
400,000 WordPress Sites Affected by Account Takeover Vulnerability in TranslatePress WordPress Plugin
Matched: WordPress
A critical vulnerability (CVE-2026-19632, CVSS 9.8) in the TranslatePress WordPress plugin affects over 400,000 sites. Unauthenticated attackers can retrieve an administrator's password reset URL from a secondary-language translation dictionary via a public AJAX endpoint, enabling full account takeover. The flaw only applies when the targeted admin's profile language is set to a published secondary language. Version 3.3.2 patches the issue; users should update immediately.