CVE-2026-89278 john-dagelmore CVE debrief

Who should care

WordPress site administrators using the GPTranslate plugin, security teams monitoring WordPress vulnerabilities, and developers maintaining WordPress sites with AI translation features

Why it matters

CVE-2026-89278 exposes AI provider API keys in the GPTranslate plugin for WordPress. Site administrators should update the plugin, rotate exposed keys, and monitor for suspicious activity. This medium-severity vulnerability allows unauthenticated attackers to access sensitive information, potentially leading to unauthorized AI usage and financial impact.

• Unauthenticated attackers can extract AI provider API keys
• Exposed API keys grant access to billed accounts
• Potential for unauthorized AI usage and costs
• Need for immediate key rotation and plugin update

Technical summary

The GPTranslate plugin for WordPress is vulnerable to Sensitive Information Exposure due to the enqueue_frontend_scripts function. This allows unauthenticated attackers to extract plaintext third-party AI provider API keys by fetching public pages and applying transformations from the plugin's JavaScript asset. The vulnerability affects all versions up to, and including, 2.34.6 and impacts configurations including the default setup and most non-DeepSeek providers. Affected configurations include the default setup (gpt-3.5-turbo in client mode) and all supported non-DeepSeek providers; only deepseek-* models and gpt-* models configured in server-proxy mode correctly suppress key emission.

Defensive priority

Medium priority for WordPress site administrators and security teams

Recommended defensive actions

• Immediately update GPTranslate plugin to a fixed version if available
• Review and rotate exposed AI provider API keys
• Restrict access to public pages if possible
• Monitor for suspicious API key usage
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

CVE-2026-89278 exposes AI provider API keys in the GPTranslate plugin for WordPress. The vulnerability allows unauthenticated attackers to extract plaintext API keys by accessing public pages and applying transformations from the plugin's JavaScript asset. Affected configurations include the default setup and most non-DeepSeek providers. The CVE details were sourced from official records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.