The TranslatePress plugin for WordPress stores administrative password-reset URLs in the translation dictionary when automatic string saving is enabled. An unauthenticated attacker can call the 'trp_get_translations_regular' AJAX action to read that dictionary and retrieve a raw reset link containing a plaintext key. Possession of this link grants the attacker the ability to reset the administrator password and gain unrestricted access to the site. The weakness is classified as CWE-640, Sensitive Information Exposure.

The vulnerability affects the 'TranslatePress – Translate Multilingual sites with AI Translation' plugin for WordPress, any installation running version 3.3.1 or earlier. No other vendors or products are listed as affected.

With a CVSS score of 9.8 the vulnerability poses a critical risk. Although the EPSS score of 2% indicates a low likelihood of exploitation, the flaw is not listed in CISA KEV, the lack of an authentication requirement means the attack can be initiated by any web visitor with access to the site. Successful exploitation requires that automatic string saving is active (the default) and that an administrator has a locale set to a secondary published language, conditions that are common in typical deployments. Once the attacker obtains the reset URL, full administrative control is achieved without further interaction.