{"data":{"id":"5095adf9-be6b-4cde-8160-5f296098fc1a","title":"CVE-2026-89278: The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is v","summary":"The GPTranslate WordPress plugin (versions up to 2.34.6) has a vulnerability where unauthenticated attackers can steal API keys (credentials that grant access to paid AI services like OpenAI or Claude) by analyzing public JavaScript files on the website. This affects most configurations except DeepSeek models and certain GPT setups run in server-proxy mode (a setup where the server handles API calls instead of the browser).","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89278","publishedAt":"2026-09-18T07:16:51.050Z","cveId":"CVE-2026-89278","cweIds":["CWE-200"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["pii_leakage"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["OpenAI","Google","Anthropic"],"affectedVendorsRaw":["OpenAI","DeepL","xAI/Grok","Google Gemini","Anthropic Claude","Google Cloud Translation"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-09-18T07:16:51.050Z","capecIds":["CAPEC-116"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}