Technical impact
The TranslatePress plugin for WordPress records administrative password‑reset URLs in its translation dictionary when automatic string saving is active. An unauthenticated visitor can invoke the 'trp_get_translations_regular' AJAX action to read that dictionary and retrieve a raw reset link containing a plaintext key. Possessing this link enables the attacker to reset the administrator password and gain unrestricted access to the site. The weakness is classified as CWE‑640, Sensitive Information Exposure.
Affected Systems
The vulnerability affects the TranslatePress – Translate Multilingual sites with AI Translation WordPress plugin for any installation running version 3.3.1 or earlier. No other vendors or products are listed as affected.
Risk and Exploitability
The CVSS score of 9.8 marks this flaw as critical. The EPSS score of 5% indicates that it has a measurable but not high exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Because it does not require authentication and is triggered by a standard AJAX request, any web visitor with access to the site can attempt exploitation. Successful exploitation occurs when automatic string saving is enabled and an administrator profile locale is set to a published secondary language – conditions that are common in typical deployments. Once the attacker obtains the reset URL, full administrative control is achieved without further interaction.
