CVE-2026-89278 john-dagelmore CVE debrief

Who should care

WordPress site administrators and defenders using the GPTranslate plugin should assess exposure and verify API key security. They should prioritize verifying and securing API keys for AI translation services, especially for WordPress sites using the GPTranslate plugin. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets.

Why it matters

The GPTranslate plugin vulnerability allows unauthenticated attackers to extract AI provider API keys, potentially leading to unauthorized access and misuse. Defenders should prioritize verifying and securing API keys, updating the plugin, and monitoring for potential misuse.

• Potential unauthorized access to AI translation services
• Risk of API key compromise and misuse
• Need for verification of API key security and plugin version
• Potential impact on site security and data integrity

Technical summary

The GPTranslate – Multilingual AI Translation Agent for WordPress plugin is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.34.6 via the enqueue_frontend_scripts. This makes it possible for unauthenticated attackers to extract the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation) — a credential granting billed account access — by fetching any public page and applying the inverse transformation bundled in the plugin's own public JavaScript asset. The vulnerability affects all versions of the GPTranslate plugin up to, and including, 2.34.6. The exposure is due to the enqueue_frontend_scripts function.

Defensive priority

Defenders should prioritize verifying and securing API keys for AI translation services, especially for WordPress sites using the GPTranslate plugin.

Recommended defensive actions

• Verify and secure API keys for AI translation services
• Update the GPTranslate plugin to a version that fixes the vulnerability
• Monitor for potential misuse of exposed API keys
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability affects all versions of the GPTranslate plugin up to, and including, 2.34.6. The exposure is due to the enqueue_frontend_scripts function. The API key exposure affects the default configuration and all supported non-DeepSeek providers.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.