🔍 源码独立审计

对 （未定位到源码） 源码进行独立审计（置信度 60%）。

🧬 根因独立理解

<p><strong>摘要：</strong>CVE-2026-19632 是 WordPress 多语言插件 TranslatePress（含 AI 翻译版）中的一个高危敏感信息暴露漏洞，CVSS 评分高达 9.8（Critical）。该漏洞影响 3.3.1 及以下所有版本，已在 3.3.2 版本中修复。由于插件在默认配置下会将包含管理员密码重置密钥的邮件内容作为翻译字符串持久化到数据库中，并且其公开的 AJAX 动作 <code>trp_get_translations_regular</code> 允许未认证攻击者枚举并提取这些字典行，攻击者可在无需任何权限的情况下获取管理员密码重置 URL，从而完全接管管理员账户。</p> <h2>📌 漏洞概述</h2> <p>TranslatePress 是一款流行的 WordPress 多语言插件，其付费版本内置 AI 翻译能力。CVE-2026-19632 被描述为“敏感信息暴露”（Sensitive Information Exposure），漏洞位于插件注册的 AJAX 动作 <code>trp_get_translations_regular</code>。该动作在 3.3.1 及之前的所有版本中均可被未认证用户调用，用于获取翻译字典表中的原文-译文对。由于插件在处理密码重置邮件翻译时会自动将包含重置链接和明文密钥的邮件原文保存为可翻译字符串，攻击者可以构造请求枚举字典 ID，直接提取管理员的重置链接，进而实现管理员账户接管。</p> <p>漏洞利用需满足以下前置条件：</p> <ul> <li>TranslatePress 版本 ≤ 3.3.1；</li> <li>插件启用“自动字符串保存”（默认开启）；</li> <li>至少存在一个已发布的次要语言（Secondary Language）；</li> <li>目标管理员用户的 WordPress 个人资料语言设置为该次要语言；</li> <li>攻击者知道目标管理员的用户名或邮箱地址。</li> </ul> <p>满足上述条件时，攻击者可在未认证状态下完成完整攻击链，最终修改管理员密码。</p> <h2>🔬 漏洞根因分析</h2> <p>该漏洞的根因来自 TranslatePress 对邮件翻译的处理机制与数据库持久化策略的组合缺陷，以及 AJAX 端点对敏感数据访问控制缺失的叠加。</p> <p>首先，TranslatePress 具备翻译外部（Outgoing）WordPress 邮件的能力。当用户请求密码重置时，WordPress 会调用 <code>wp_mail()</code> 发送包含重置链接（形如 <code>https://example.com/wp-login.php?action=rp&key=...&login=admin</code>）的邮件。如果启用邮件翻译，且收件人的个人资料语言设置为某个已发布的次要语言，TranslatePress 会将该邮件的内容视为待翻译文本，通过其翻译流水线进行处理。在此过程中，插件会将未经脱敏的原始邮件文本（包括完整的重置链接、明文 key 值和登录名）作为“原文”保存到翻译字典表（通常是 <code>wp_trp_dictionary_&lt;语言码&gt;</code> 表）中。按照设计，字典表用于存储待翻译的字符串及其译文，但保存的原文并不仅限于普通内容，而是涵盖了任何经过插件翻译管道的文本，其中就包含高度敏感的认证凭据。</p> <p>其次，<code>trp_get_translations_regular</code> 这个 AJAX 动作被注册为公开可访问，即无需登录 WordPress 后台即可调用。其设计目的是允许前台页面异步加载翻译字符串，因此底层的 nonce 会在公开的翻译页面中通过脚本形式渲染出来，攻击者只需访问某个翻译后的页面即可提取该 nonce。更严重的是，该接口未对请求者的身份或权限进行校验，也不对查询的字典行 ID 范围进行限制。攻击者可以通过循环枚举 ID，批量读取字典表中的记录。由于字典表中存有密码重置邮件原文，攻击者枚举到特定行后即可提取完整的重置链接。</p> <p>攻击的完整利用链如下：</p> <ol> <li>攻击者获知目标管理员的用户名或邮箱，并确认站点存在已发布的次要语言（如希伯来语 <code>/he/</code>）；</li> <li>攻击者诱使目标管理员发起一次密码重置（或通过其他方式触发重置邮件）；</li> <li>TranslatePress 将重置邮件翻译为次要语言，并将包含重置链接的原文写入翻译字典表；</li> <li>攻击者访问一个公开的翻译页面，从页面源码中提取 AJAX non

🛤️ 漏洞触发链路

🧪 PoC 复现

从 GitHub 公开仓库抓取的实际 PoC 代码（仓库）。

📋 代码元数据语言md来源YonLiud/CVE-2026-19632针对性✅ 已验证与漏洞相关（代码含 CVE 引用）依赖见代码注释/README用法详见代码注释中的使用说明

# TranslatePress Password Reset Link Disclosure to Administrator Account Takeover

**CVE:** CVE-2026-19632 |**CVSS:** 9.8 (Critical)


Unauthenticated account-takeover via TranslatePress plugin for wordpress.
Time from CVE publication to working Day-One PoC: **5 hours,9 minutes,40 seconds**

Up to and including 3.3.1;
the issue was patched in 3.3.2.

## TLDR

TranslatePress can translate outgoing WordPress emails and save their translated strings in its database.<br />
TranslatePress also saves password-reset emails with the full reset link including the secret key directly into the translation table.

An unauthenticated attacker can then query those rows through a public TranslatePress AJAX action:

```
Trigger password reset
        ->reset email is translated
        ->reset URL is saved in the secondary-language dictionary
        ->
public AJAX endpoint returns the row
        ->
use URL to set a new administrator password
```

## Demo

https://github.com/user-attachments/assets/83469be4-ab85-4380-aedc-4d0406ab5a6b

## The vulnerability

The exploit chain requires:

- TranslatePress 3.3.1 or earlier.
- Automatic string saving enabled.
- A published secondary language.
- The target user's WordPress profile locale set to that secondary language.
- Knowledge of the target username or email address.

When WordPress sends the reset email,
TranslatePress switches to the recipient's preferred language and passes the email through its translation pipeline. The vulnerable version saves strings encountered during this process,including the reset URL.

TranslatePress also registers `trp_get_translations_regular` for unauthenticated visitors. Its `nonce` is exposed on a public translated page,
and the request accepts attacker selected dictionary row IDs. Enumerating those IDs reveals the stored reset email and its usable reset link.

## Exploit flow

|Step |Action ||---:|---||1 |Load `/he/cve-lab-seed/` and extract the public TranslatePress AJAX nonce. ||2 |Submit WordPress's lost-password form for `labadmin`. ||3 |
TranslatePress processes the reset email using the administrator's Hebrew locale. ||4 |Enumerate dictionary rows through `trp_get_translations_regular`. ||5 |Extract the newest matching `wp-login.php?action=rp` reset URL. ||6 |Open the URL and submit a new password. ||7 |Perform a fresh login and require both a WordPress login cookie and `/wp-admin/` access. |
The relevant unauthenticated request has this shape:

```http
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: 127.0.0.1:19632
Content-Type: application/x-www-form-urlencoded

action=trp_get_translations_regular&security=PUBLIC_NONCE&language=he_IL&string_ids=[1,2,3]
```

The nonce and useful row ID are dynamic,
so `exploit.py` discovers them rather than hardcoding them.

## Usage

Minimal usage:

```bash
python3 .\exploit.py --new-password 'Your-New-Password!'
```



```bash
python3 .\exploit.py \
  --url http://127.0.0.1:19632 \
  --username labadmin \
  --language he_IL \
  --public-path /he/cve-lab-seed/ \
  --start-id 1 \
  --max-id 500 \
  --batch-size 100 \
  --timeout 15 \
  --settle-seconds 1 \
  --stop-after takeover \
  --new-password 'Your-New-Password!'
```

Leak the reset URL without changing the password:

```powershell
python .\exploit.py --stop-after leak
```

Trigger only the password-reset email:

```powershell
python .\exploit.py --stop-after reset
```

### Parameters

|
Parameter |Default |Purpose ||---|---|---||`--url` |`http://127.0.0.1:19632` |WordPress base URL. ||`--username` |`labadmin` |Account for which the reset is requested. ||`--language` |`he_IL` |Secondary-language dictionary queried by the PoC. ||`--public-path` |`/he/cve-lab-seed/` |Public translated page used to obtain the AJAX nonce. ||`--new-password` |None |New password;
required when `--stop-after takeover` is used. ||`--start-id` |`1` |First dictionary row ID to request. ||`--max-id` |`500` |Last dictionary row ID to request. Increase it if no reset URL is found. ||`--batch-size` |`100` |Dictionary IDs requested per AJAX call. Valid range: 1-500. ||`--timeout` |`15` |HTTP timeout in seconds. ||`--settle-seconds` |`1` |Delay after requesting the reset email. ||
`--stop-after` |`takeover` |Stop after `reset`,`leak`,or the full `takeover`. |## Disclaimer


This project is intended solely for authorized security research,education,and testing in isolated laboratory environments.

This vulnerability was originally discovered and disclosed by `momopon1415`.
Do not use this software against systems,networks,
or data without explicit authorization from the owner. You are solely responsible for complying with all applicable laws and for any consequences resulting from your use of this project.

The author,YonLiud,provides this project “as is,” without warranties of any kind,and accepts no responsibility for damage,data loss,service disruption,unauthorized access,
or other misuse caused by this software or derivative works.

By using this project,you acknowledge and accept these conditions.

⚔️ EXP 利用代码

截至分析时，Exploit-DB 未收录该 CVE 的公开利用代码。可利用上述 PoC 进行验证，或关注 Exploit-DB 更新。

🕵️ 检测指纹

当前规则库未收录针对该 CVE 的专用检测规则。建议：

• 根据漏洞根因编写 Nuclei 检测模板
• 在 WAF/IDS 中配置针对漏洞特征的规则
• 关注漏洞指纹库更新

🤖 高危漏洞深度独立研究引擎生成 · 2026-08-30 03:01