AIKIDO-2026-268431

TL;DR

The unauthenticated trp_get_translations_regular AJAX action returns strings from the secondary-language translation dictionary, including values persisted when automatic string saving is enabled. If an administrator whose profile locale is a published secondary language requests a password reset, that reset URL (with plaintext key and login) can be stored as a translatable string and later read by anyone calling the AJAX endpoint, enabling full account takeover. The fix stops password-reset URLs and similar sensitive strings from being exposed through the translation dictionary API.