CVE-2026-89278: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in john-dagelmore GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI
The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.34.6 via the enqueue_frontend_scripts. This makes it possible for unauthenticated attackers to extract the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation) — a credential granting billed account access — by fetching any public page and applying the inverse transformation bundled in the plugin's own public JavaScript asset. This exposure affects the default configuration (gpt-3.5-turbo in client mode) and all supported non-DeepSeek providers; only deepseek-* models and gpt-* models configured in server-proxy mode correctly suppress key emission.
AI Analysis
Technical Summary
CVE-2026-89278 is a sensitive information exposure vulnerability (CWE-200) in the GPTranslate – Multilingual AI Translation Agent for WordPress plugin. Versions up to and including 2.34.6 leak plaintext API keys for third-party AI translation providers via the enqueue_frontend_scripts function. Attackers can fetch any public page and reverse the transformation in the plugin's public JavaScript to extract these keys. This affects the default client mode (gpt-3.5-turbo) and all non-DeepSeek providers. Server-proxy mode and DeepSeek models suppress key emission properly. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity).
Potential Impact
An unauthenticated attacker can obtain plaintext API keys for third-party AI translation services integrated with the plugin. These keys grant access to billed accounts, potentially leading to unauthorized usage and financial impact. There is no direct impact on confidentiality of site data or integrity, but exposure of credentials can lead to abuse of AI translation services.
Mitigation Recommendations
A patch is available for this vulnerability. Users should update the GPTranslate plugin to a fixed version beyond 2.34.6. Alternatively, configuring the plugin to use server-proxy mode or DeepSeek models prevents API key exposure. No additional mitigation is required if these configurations are already in use.
CVE-2026-89278: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in john-dagelmore GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI
Description
The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.34.6 via the enqueue_frontend_scripts. This makes it possible for unauthenticated attackers to extract the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation) — a credential granting billed account access — by fetching any public page and applying the inverse transformation bundled in the plugin's own public JavaScript asset. This exposure affects the default configuration (gpt-3.5-turbo in client mode) and all supported non-DeepSeek providers; only deepseek-* models and gpt-* models configured in server-proxy mode correctly suppress key emission.
CVSS v3.1
Score 5.3medium
Affected software
john-dagelmore
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-89278 is a sensitive information exposure vulnerability (CWE-200) in the GPTranslate – Multilingual AI Translation Agent for WordPress plugin. Versions up to and including 2.34.6 leak plaintext API keys for third-party AI translation providers via the enqueue_frontend_scripts function. Attackers can fetch any public page and reverse the transformation in the plugin's public JavaScript to extract these keys. This affects the default client mode (gpt-3.5-turbo) and all non-DeepSeek providers. Server-proxy mode and DeepSeek models suppress key emission properly. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity).
Potential Impact
An unauthenticated attacker can obtain plaintext API keys for third-party AI translation services integrated with the plugin. These keys grant access to billed accounts, potentially leading to unauthorized usage and financial impact. There is no direct impact on confidentiality of site data or integrity, but exposure of credentials can lead to abuse of AI translation services.
Mitigation Recommendations
A patch is available for this vulnerability. Users should update the GPTranslate plugin to a fixed version beyond 2.34.6. Alternatively, configuring the plugin to use server-proxy mode or DeepSeek models prevents API key exposure. No additional mitigation is required if these configurations are already in use.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-09-11T11:15:53.864Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6aace1f355bf5e2cf5a3c685
Added to database: 09/18/2026, 07:02:11 UTC
Last enriched: 09/18/2026, 07:17:02 UTC
Last updated: 09/19/2026, 02:16:29 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.