Translating a website into several languages does not exactly sound like the kind of feature that could let someone take over your entire WordPress site. Right?

And yet that is exactly the kind of problem found in the popular TranslatePress plugin, used on more than 400,000 websites.

The issue affects versions 3.3.1 and older. Under certain conditions, someone with no account at all on your site can obtain the password-reset link intended for an administrator. They can then set their own password and sign in as an administrator. Almost too easy, right?

WebsiteGarage / Services

Explore our services.

So we are not talking about a badly translated button or a broken menu.

We are talking about the possibility of taking over the WordPress admin.

Who is affected?

Not every site using TranslatePress was vulnerable under the same conditions. The attack is possible when the language set in an administrator’s profile is one of the additional languages published on the site.

But a business owner really should not have to start analysing the language settings of admin accounts and wondering whether the site happens to meet every condition required for the attack.

If you use TranslatePress, the answer is much simpler:

check the version and update the plugin.

What should you do now?

If you have TranslatePress 3.3.1 or older, update the plugin. The problem was fixed in version 3.3.2, and the newer version 3.3.3 is already available on WordPress.org.

If someone else manages your website, you do not need to know where to look. Send them one question:

“Do we use TranslatePress, and is it up to date?”

If the site was running a vulnerable version for some time and met the conditions for the attack, it is also worth asking the person who manages WordPress to check for unknown administrator accounts or other signs of unauthorised access.

The update closes the vulnerability going forward, but it cannot undo anything that may already have happened.

“I have Wordfence, so this doesn’t affect me”?

I would not count on that.

Paid versions of Wordfence received additional protection against this specific attack on 13 August. The free version is due to receive the same rule on 12 September.

More importantly, a firewall should not be a reason to leave a vulnerable plugin in place. A fixed version is available, so updating is simply the right solution.

What can happen if an administrator account is taken over?

A WordPress administrator can do a lot. Anyone who takes over that account can change site content, create more accounts, install additional software or leave themselves a hidden way back in.

For a shop or a website collecting data through forms, the consequences can of course be much more serious than simply replacing the homepage.

That is exactly why this vulnerability deserves a response even if your website looks completely normal today.

WEBSITEGARAGE SAYS

This is a perfect example of a familiar problem:

“It’s only a translation plugin.”

In WordPress, “it’s only a plugin for…” can be a surprisingly ominous way to start a sentence.

A plugin does not need Security, Login or User Management in its name for a bug in it to end up giving someone administrator access.

And that is exactly why sensible WordPress maintenance is not about waiting until the website stops working.

Because in this case, it could be working perfectly.

Complete with a new administrator you never created.

If you use TranslatePress: check the version and update.

Five minutes today is much nicer than later trying to work out who actually has access to your website. Or where your data went.

Sources