Hi Mihai,
Thank you for the quick and thoughtful reply, I appreciate you escalating this internally. But it has been a few days and I still didn't hear from anybody.
To summarize:
On security: You're right, and I don't dispute it. Securing the site was my responsibility. The intrusion has been fully remediated (rogue admin accounts removed, malicious plugin deleted, all credentials rotated, full malware scan completed with zero threats found), and I've already switched to manual translation, exactly as you recommend.
On the credits, there are four points I'd ask you to carry into the escalation:
1. I did not choose automatic translation on my own. I was using prepaid credits and was perfectly happy with that setup. My exposure was capped by whatever I had loaded. It was WPML's own marketing emails that repeatedly encouraged me to enable automatic translation and move to Pay-As-You-Go. I followed your recommendation, and in doing so the spending ceiling I previously had disappeared.
2. Nowhere does WPML warn users to secure their site before enabling automatic translation. There is no notice at activation saying that a compromised site could burn thousands of euros in credits overnight. Your reply to me contains that warning but the product itself never did. How was I supposed to anticipate that my site would be hacked, and that WPML would translate the attacker's content at my expense?
3. There is no anomaly alert and no spend cap. A single "unusual translation volume detected" notification, or a configurable monthly limit, would have stopped this on day one. Instead, 26.5 million credits were consumed over roughly three days with no interruption and no notification of any kind.
4. The translated content was obviously unrelated to my site. I run a plastic surgery practice. The content suddenly being translated was gambling spam: 1xbet, Mostbet, casino pages, in Russian, Polish, Maltese and other languages I have never published in. This is not a subtle anomaly. Compared to my routine translation activity, it is a complete and abrupt departure that any basic monitoring would flag.
I'm not asking WPML to absorb my legitimate usage. Based on your own July usage report, roughly 72% of this cycle's jobs (about 4,500 of 6,302) are translations of these fraudulent gambling URLs, clearly identifiable by their permalinks. I'm asking for a waiver of that portion only, and I'll gladly pay the rest.
Two practical requests:
• Could the charge be placed on hold until the escalation concludes? My dashboard shows the next invoice dated August 1, while your message mentions the 3rd of the following month. I'd appreciate clarification on which applies, so this isn't billed before a decision is reached.
• Whatever the outcome, I'd encourage the team to add a spend cap or anomaly alert for Pay-As-You-Go accounts. If WPML is willing to recommend automatic translation this actively, the product should also protect users from this scenario.
Happy to provide the malware scan report or server access logs documenting the intrusion if that helps the internal review.
Thank you again for taking this seriously.
Best regards,
Dr. Mustafa Aydınol
hidden link
