CVE-2026-89278: The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is v
mediumvulnerabilityLLM-Specific
security
Summary
The GPTranslate WordPress plugin (versions up to 2.34.6) has a vulnerability where unauthenticated attackers can steal API keys (credentials that grant access to paid AI services like OpenAI or Claude) by analyzing public JavaScript files on the website. This affects most configurations except DeepSeek models and certain GPT setups run in server-proxy mode (a setup where the server handles API calls instead of the browser).
Vulnerability Details
CVSS Score
5.3(medium)
EPSS (30-day exploit probability)
EPSS: 0.0%
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
network
Attack Complexity
low
Privileges Required
none
User Interaction
none
Disclosure Date
September 18, 2026
Classification
Attack Type
PII Leakage
Attack SophisticationTrivial
Impact (CIA+S)
confidentiality
AI Component TargetedAPI
Affected Vendors
OpenAIGoogleAnthropic
Related Issues
Monthly digest — independent AI security research
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-89278
First tracked: September 18, 2026 at 08:08 AM
Classified by LLM (prompt v3) · confidence: 95%