TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 3 proofs of concept on GitHub, 1 Nuclei template
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters stored in the translation dictionary table — enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation
through 3.3.1
References 14
plugins.trac.wordpress.org
- browser/translatepress-multilingual/tags/3.3.1/class-translate-press.php#L531
- browser/translatepress-multilingual/tags/3.3.1/includes/class-translation-render.php#L2371
- browser/translatepress-multilingual/tags/3.3.1/includes/class-translation-render.php#L2061
- browser/translatepress-multilingual/tags/3.3.1/class-translate-press.php#L361
- browser/translatepress-multilingual/tags/3.3.1/includes/class-translation-render.php#L2257
- browser/translatepress-multilingual/tags/3.3.1/includes/class-editor-api-regular-strings.php#L35
- browser/translatepress-multilingual/tags/3.3.1/includes/class-editor-api-regular-strings.php#L93
- browser/translatepress-multilingual/tags/3.3.1/includes/queries/class-query.php#L1258
- changeset/3645229/translatepress-multilingual