A critical vulnerability in the TranslatePress plugin for WordPress could allow an account to escalate privileges and take complete control of a website. The entry, CVE-2026-78267, affects versions up to 3.3.2 and requires immediate assessment by administrators.
NVD describes the TranslatePress vulnerability as an unauthenticated elevation of privilege and attributes the issue to improper privilege assignment. Patchstack, in its corresponding technical entry, talks about an attacker starting from a low-privilege account.
The difference in wording does not change the practical conclusion: a WordPress site with an old version of TranslatePress should be checked and updated. Patchstack rates the TranslatePress vulnerability as high priority, with a CVSS of 9.8, and states that version 3.3.3 fixes the issue.
See also: miniOrange SAML: Critical login bypass threatens WordPress
The TranslatePress vulnerability and CVE-2026-78267
TranslatePress is used to translate pages directly from the website environment and supports themes, plugins, WooCommerce, and page builders. Because it works on content and settings associated with WordPress accounts, incorrect privilege assignment can turn a limited user into an administrator.
The TranslatePress vulnerability, listed as CVE-2026-78267, affects versions 3.3.2 and older. NVD has yet to publish its own CVSS score or provide a more in-depth technical cause, while the Patchstack entry assigns a high priority and describes a potential full site takeover if the attacker gains elevated privileges.
This means that the attack is not limited to displaying unwanted content. An account with elevated privileges can be used to change settings, install other plugins, modify users, or access data. The final outcome depends on the privileges granted and the rest of the website's defenses.
The Patchstack entry lists the report date as August 9th and attributes the discovery to ChuongVN. The timeline also shows an update on August 24th, indicating that administrators should check the latest version and not rely solely on the date a CVE was published.
How WordPress sites are affected
Administrators often allow editors, translators, or collaborators to work on content without access to critical settings. The TranslatePress vulnerability is particularly important in such environments because a compromise of a lower-level account can extend access beyond the original role.
The official plugin on WordPress.org shows version 3.3.3 and lists recent security fixes. The page does not explicitly link the version to CVE-2026-78267, so teams investigating an incident should keep a copy of the logs and confirm the version before drawing any conclusions.
The absence of an explicit reference to the CVE from the public changelog is not a reason for deferral. On installations hosting an online store, membership site, or multi-author content, the exposure of a translation plugin can impact both content and login processes.
See also: WebToffee WooCommerce: New vulnerability allows reading files
In an initial audit, it's worth looking at recent user logins, role changes, new plugin installations, and wp-admin modifications. At the same time, you should review accounts that no longer require access and enable multi-factor protection where supported.
Audits should also cover backups, so that modified code is not kept in an old snapshot that is later reverted. Recording the current version, active users, and recent changes creates a reference point for re-auditing after an update.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Immediate information and control
The basic action is to upgrade TranslatePress to version 3.3.3 or later, after taking a backup and confirming compatibility with the theme and other plugins. In a production environment, the change should be tested in a test environment and documented by the management team.
See also: Forminator Forms: Critical vulnerability affects WordPress website
After the upgrade, the management team should review roles and limit permissions to strictly necessary functionality. Temporarily disabling the add-on when not required for the site to function can reduce exposure until the audit is complete.
If there are signs of unauthorized changes, the SecNews technical team recommends isolating the site, renewing credentials, checking administrative accounts, and looking for unknown files or plugins. Updating closes the known path, but verification is still necessary to determine if abuse occurred.
