CVE-2026-89278: plaintext AI API key exposed to

CISO Take

The GPTranslate WordPress plugin (up to 2.34.6) embeds the site's third-party AI provider API key (OpenAI, DeepL, Grok, Gemini, Claude, Google Translate) in public JavaScript, obfuscated only by a reversible transformation, so any unauthenticated visitor can recover it by loading a public page. The CVSS is a modest 5.3 and EPSS is low (0.00438, 64th percentile), with no public exploit, Nuclei template or KEV listing, but exploitation is trivial and the stolen key gives billed access to the victim's AI account. The real exposure is financial abuse (cost harvesting, resold access) and loss of control over any data tied to that key, not site compromise. Update to a version newer than 2.34.6 once the vendor ships a fix, immediately rotate any provider key used by the plugin, set spending caps on those keys, and switch to server-proxy mode where supported.

Sources:NVDEPSSATLASwordfence.complugins.trac.wordpress.org

What is the risk?

Medium by CVSS, but practical risk is higher for organizations with uncapped AI provider billing. Exploitation needs no authentication, no user interaction and no special skill, and the default configuration (gpt-3.5-turbo in client mode) is affected. EPSS is low and there is no public exploit or KEV listing, so mass exploitation is not yet observed, though automated scraping of public pages for keys is a well-established pattern. Impact is confined to confidentiality of the API key, but the credential carries direct financial consequences and can enable abuse of the victim's AI account.

How does the attack unfold?

Reconnaissance

Attacker identifies WordPress sites running GPTranslate and fetches a public page and the plugin's JavaScript asset.

AML.T0003

Credential Extraction

Attacker applies the inverse transformation bundled in the public JS to recover the plaintext AI provider API key.

AML.T0055

Key Abuse

Attacker uses the valid key to call the provider's API directly with the victim's billing account.

AML.T0040

Impact

Victim incurs unexpected charges, quota exhaustion and potential service disruption or account-level exposure.

AML.T0034

Reconnaissance

Attacker identifies WordPress sites running GPTranslate and fetches a public page and the plugin's JavaScript asset.

AML.T0003

Credential Extraction

Attacker applies the inverse transformation bundled in the public JS to recover the plaintext AI provider API key.

AML.T0055

Key Abuse

Attacker uses the valid key to call the provider's API directly with the victim's billing account.

AML.T0040

Impact

Victim incurs unexpected charges, quota exhaustion and potential service disruption or account-level exposure.

AML.T0034

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CLow

INone

ANone

What should I do?

1 step

1) Upgrade the plugin to a patched version as soon as one is released (check the vendor changelog and Wordfence advisory); versions up to and including 2.34.6 are vulnerable. 2) Treat every provider key configured in the plugin as compromised: revoke and rotate it, and never reuse it elsewhere. 3) Use a dedicated, least-privilege key with hard monthly spend limits and rate limits per provider. 4) Where available, switch to server-proxy mode or a deepseek-* model so the key is not emitted to the frontend. 5) Detect abuse by reviewing provider usage dashboards for unexpected spikes, unfamiliar IPs or models, and set billing alerts. 6) Inspect page source and the plugin's frontend JS for the key, and consider a WAF or secret-scanning check on public assets.

How is it classified?

Data LeakageData ExtractionPluginAPIAML.T0003- Search Victim-Owned Websites AML.T0034- Cost Harvesting AML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-89278?

The GPTranslate WordPress plugin (up to 2.34.6) embeds the site's third-party AI provider API key (OpenAI, DeepL, Grok, Gemini, Claude, Google Translate) in public JavaScript, obfuscated only by a reversible transformation, so any unauthenticated visitor can recover it by loading a public page. The CVSS is a modest 5.3 and EPSS is low (0.00438, 64th percentile), with no public exploit, Nuclei template or KEV listing, but exploitation is trivial and the stolen key gives billed access to the victim's AI account. The real exposure is financial abuse (cost harvesting, resold access) and loss of control over any data tied to that key, not site compromise. Update to a version newer than 2.34.6 once the vendor ships a fix, immediately rotate any provider key used by the plugin, set spending caps on those keys, and switch to server-proxy mode where supported.

Is CVE-2026-89278 actively exploited?

No confirmed active exploitation of CVE-2026-89278 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-89278?

1) Upgrade the plugin to a patched version as soon as one is released (check the vendor changelog and Wordfence advisory); versions up to and including 2.34.6 are vulnerable. 2) Treat every provider key configured in the plugin as compromised: revoke and rotate it, and never reuse it elsewhere. 3) Use a dedicated, least-privilege key with hard monthly spend limits and rate limits per provider. 4) Where available, switch to server-proxy mode or a deepseek-* model so the key is not emitted to the frontend. 5) Detect abuse by reviewing provider usage dashboards for unexpected spikes, unfamiliar IPs or models, and set billing alerts. 6) Inspect page source and the plugin's frontend JS for the key, and consider a WAF or secret-scanning check on public assets.

What systems are affected by CVE-2026-89278?

This vulnerability affects the following AI/ML architecture patterns: WordPress AI plugins, LLM API integrations, Client-side AI translation.

What is the CVSS score for CVE-2026-89278?

CVE-2026-89278 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.44%.

What is the AI security impact?

Affected AI Architectures

WordPress AI pluginsLLM API integrationsClient-side AI translation

MITRE ATLAS Techniques

AML.T0003Search Victim-Owned Websites

AML.T0034Cost Harvesting

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

Compliance Controls Affected

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM03

What are the technical details?

Original Advisory

The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.34.6 via the enqueue_frontend_scripts. This makes it possible for unauthenticated attackers to extract the plaintext third-party AI provider API key (OpenAI, DeepL, xAI/Grok, Gemini, Claude, or Google Cloud Translation) — a credential granting billed account access — by fetching any public page and applying the inverse transformation bundled in the plugin's own public JavaScript asset. This exposure affects the default configuration (gpt-3.5-turbo in client mode) and all supported non-DeepSeek providers; only deepseek-* models and gpt-* models configured in server-proxy mode correctly suppress key emission.

Exploitation Scenario

An attacker crawls WordPress sites that load the GPTranslate frontend script, fetches any public page and the plugin's JavaScript, applies the documented inverse transformation and recovers the plaintext OpenAI or other provider key. They validate the key with a cheap API call, then use it to run high-volume inference, resell access through an AI proxy service, or power abuse campaigns, leaving the site owner with a large bill and possible quota exhaustion that breaks the site's translation features.

Weaknesses (CWE)

CWE-200Exposure of Sensitive Information to an Unauthorized ActorPrimary CWE-200Exposure of Sensitive Information to an Unauthorized Actor

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.