CVE-2026-89278

Name of the Vulnerable Software and Affected Versions GPTranslate – Multilingual AI Translation Agent for WordPress versions prior to 2.34.7

Description Sensitive information exposure occurs via the enqueue frontend scripts function. Unauthenticated attackers can extract plaintext third-party AI provider API keys for OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation by fetching a public page and applying an inverse transformation found in the plugin's public JavaScript asset. This issue affects the default configuration using gpt-3.5-turbo in client mode and all supported providers except DeepSeek. Only deepseek-* models and gpt-* models configured in server-proxy mode prevent the emission of these keys.

Recommendations Update GPTranslate – Multilingual AI Translation Agent for WordPress to version 2.34.7 or later. As a temporary mitigation, configure gpt-* models to use server-proxy mode or use deepseek-* models to suppress API key emission.