WordPress sites running TranslatePress 3.3.1 or earlier should be updated. CVE-2026-19632 describes a flaw that could expose an administrator password-reset link. The advisory lists 3.3.2 as the first fixed version; the official plugin page showed a later release, 3.3.8, when this article was prepared on 4 November 2026. Install the latest version available for your site. Wordfence's advisory, the CVE record and the WordPress.org plugin page provide the technical and version details.
Who may be exposed?
The advisory describes a specific combination: automatic string saving is enabled, and the targeted administrator's profile uses a published secondary language. Under those conditions, a password-reset URL could be saved in a translation dictionary and exposed through a TranslatePress request. The URL contains a reset key that could allow an attacker to change the password and attempt to take over the account.
Those conditions help prioritize a review, but they do not make an old plugin safe. Update the plugin even if you do not think the configuration matches. Conversely, having an affected version does not prove that someone used the flaw or accessed your WordPress dashboard.
What should I do first?
- In WordPress Admin, check the installed TranslatePress version. If it is 3.3.1 or older, update to the latest available version. The advisory's minimum fixed release is 3.3.2; later releases may address additional issues.
- Verify the running version after the update. Review whether automatic string saving is enabled and which languages are assigned to administrator profiles.
- Preserve the relevant web-server, WordPress and security-plugin logs. Look for unexpected password-reset activity, unfamiliar administrator logins, new admin accounts or changes to plugins, themes and site content.
- If the site was vulnerable and met the described conditions—or if you find suspicious activity—patch first, then reset administrator passwords and revoke active sessions or application passwords where supported. Enable two-factor authentication and review other credentials if compromise indicators exist.
Do not publish or share password-reset URLs, reset keys or test exploit links. They can function like credentials. Do not run proof-of-concept tests against a production site unless you are authorized and have a safe test environment.
Does an old TranslatePress version mean my site was hacked?
No. A vulnerable version creates a risk; it does not establish that the vulnerability was exploited. Wordfence reported firewall activity related to the issue, but network-level targeting or blocked requests do not prove successful compromise of any specific site. If you find indicators, preserve evidence and ask your host or a qualified incident-response provider to investigate before making large changes.
After patching, test translated pages, language switching and administrator access. Check the site's updates again later, because the minimum version that fixes this CVE is not necessarily the latest safe version today.
For WordPress security scanning, malware response and hardening, Engage24's Website Security service is the closest match on the current site. If the incident is affecting staff email, PCs or Macs as well, Engage24 IT Support outlines the related workplace technology support currently offered.
Need help securing your TranslatePress site?
If you need help updating TranslatePress, reviewing account settings or assessing suspicious account activity, book time with Engage24.