CVE-2026-9109: Stored XSS in GPTranslate for WordPress

How to detect exposure

Start with version discovery. Determine whether the plugin is installed and whether the deployed version is 2.31 or earlier. On managed WordPress fleets, use WP-CLI, host inventory, or file-based asset discovery to enumerate plugin versions centrally rather than checking by hand.

Then validate whether the exposure condition described by NVD is present. The issue notes that gptApiKey is printed in page source. If that variable is visible to unauthenticated visitors, the path to exploitation is materially easier because the key can be recovered directly from HTML and reused against the REST endpoint.

Technical Notes

Use WP-CLI to identify the installed plugin version:

wp plugin list --format=table | grep -i gptranslate

If you need machine-readable output across multiple sites:

wp plugin list --format=json | jq '.[] | select(.name=="gptranslate")'

Check whether the page source exposes gptApiKey:

curl -s https://example.com/ | grep -o 'gptApiKey[^<]*'

Search access logs for requests to the plugin REST endpoint:

grep -R 'wp-json/gptranslate/v1/request' /var/log/nginx /var/log/apache2 2>/dev/null

Example suspicious log pattern:

POST /wp-json/gptranslate/v1/request HTTP/1.1
User-Agent: Mozilla/5.0
Content-Type: application/json

If you log request bodies at a reverse proxy, look for obvious script markers in submitted translation content:

<script
onerror=
onload=
javascript:
<svg
<img

Example Splunk search:

index=web_logs ("POST /wp-json/gptranslate/v1/request" OR "/wp-json/gptranslate/v1/request")
| stats count by src_ip, user_agent, uri_path, http_status

Example Sigma-style detection logic concept for web logs:

title: Suspicious Requests to GPTranslate REST Endpoint
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: "/wp-json/gptranslate/v1/request"
    cs-method: "POST"
  condition: selection
level: medium

You should also review rendered pages for unexpected translated content, especially if users report pop-ups, redirects, broken layouts, or admin sessions behaving abnormally. Because this is stored XSS, the earliest sign may be browser-side behavior rather than server-side errors.

Mitigation and patching

The safest mitigation is to upgrade to the latest available version, 2.33.2, because the exact first fixed version was not explicitly confirmed from the retrieved primary-source advisory text. If you are on 2.31 or earlier, treat the system as vulnerable and prioritize update windows accordingly.

If immediate patching is not possible, risk reduction should focus on removing exposure to the vulnerable endpoint and reducing the chance that malicious content can be injected or rendered. That may include temporarily disabling the plugin, restricting access to the affected site behind authentication or IP allowlists where business-appropriate, and using a WAF or reverse proxy rule to block requests to the GPTranslate REST route until the upgrade is complete.

Because this is stored XSS, patching alone may not fully close the incident if exploitation already occurred. After upgrading, review existing translated content and database-backed translation entries for malicious payloads. Also force reauthentication for privileged users if you suspect admin browsers loaded injected pages.

Technical Notes

Upgrade with WP-CLI:

wp plugin update gptranslate --version=2.33.2

If you simply want the latest available release:

wp plugin update gptranslate

Verify the result:

wp plugin list --format=table | grep -i gptranslate

Temporarily deactivate the plugin if you cannot patch immediately:

wp plugin deactivate gptranslate

Example Nginx workaround to block the vulnerable REST path until remediation is complete:

location = /wp-json/gptranslate/v1/request {
    deny all;
    return 403;
}

Example Apache workaround:

<Location "/wp-json/gptranslate/v1/request">
    Require all denied
</Location>

If you use ModSecurity or a WAF, consider a targeted temporary block on POST requests to the endpoint, especially those containing script-like payload markers. Be careful with broad XSS signatures if your site legitimately handles multilingual punctuation or HTML fragments.

Incident response considerations

If you find evidence of suspicious POSTs to /wp-json/gptranslate/v1/request, do not stop at patch validation. Treat the site as potentially having malicious stored content already persisted. Review plugin data, recently modified pages, translation records, and template output areas where translated text is rendered.

You should also assume administrator session exposure is possible if privileged users visited affected pages before remediation. That may warrant session invalidation, password resets for privileged accounts, and review of audit logs for unauthorized admin actions such as plugin installs, theme edits, user creation, or option changes.

For SMB environments without mature logging, the absence of evidence should not be read as evidence of no exploitation. WordPress sites often lack detailed request-body retention and browser telemetry. In that situation, the defensible posture is: update, inspect visible content, invalidate admin sessions, and monitor closely for repeat access to the vulnerable endpoint.

References

• NVD record for CVE-2026-9109
• CISA KEV lookup for CVE-2026-9109
• WordPress.org plugin page for GPTranslate: https://wordpress.org/plugins/gptranslate/?output_format=md
• Wordfence plugin vulnerability reference: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/gptranslate

For further reading on security best practices, consider checking our articles on compensating controls and cloud security.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.