An unauthenticated vulnerability in the TranslatePress WordPress plugin allows an attacker to gain administrative privileges on a site. Because the flaw is accessed without authentication, any visitor can exploit the weakness, moving from a typical read‑only user to a superuser level. The impact includes full control over site content, user accounts, and plugin settings, effectively giving the attacker ownership of the website. The listed weakness is CWE‑266, indicating improper usage of privileged capabilities.

The TranslatePress plugin by Cozmoslabs, version 3.3.2 and earlier, is affected. Sites running these older builds are susceptible; upgrading to at least version 3.3.3 eliminates the flaw.

The assessment assigns a CVSS score of 9.8, categorizing the flaw as critical. There is no EPSS data, so we cannot gauge current exploitation probability, and the vulnerability is not currently recorded in the CISA KEV catalog. The attack vector is inferred to be a web request to the plugin’s endpoint, given the unauthenticated nature of the flaw. An attacker exploiting this condition could immediately gain administrative control of the WordPress site.