Loco Translate <= 2.8.8 - Authenticated (Translator+) Arbitrary File and Directory Deletion via Backup Revision Delete
- ID
- WPSEC-2026-0042
- Plugin
- Loco Translate (loco-translate)
- Affected
- from 2.1.0 before 2.8.9
- Remediation
- Update to 2.8.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
- Weakness
- CWE-22
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Loco Translate on WPSec AttackSurface
- Fix released
- Published
Description
The Loco Translate plugin for WordPress is vulnerable to arbitrary file and directory deletion in versions 2.1.0 up to, and including, 2.8.8. The file restore screen resolved the posted 'delete' (and 'backup') path against the wp-content directory without checking that it named a genuine backup revision of the PO file being managed. This makes it possible for authenticated attackers with access to Loco Translate (administrators by default, plus any role an administrator grants the loco_admin capability, such as the plugin's Translator role) to delete any path that passes the plugin's write rules: translation-type files (.po, .pot, .mo, .json, .txt, .xml, .zip) and any extension-less path, including whole directories such as a plugin's folder or the uploads directory, which are removed recursively. In current releases the default base-directory setting confines this to wp-content and PHP files such as wp-config.php cannot be deleted, but releases before 2.5.4 applied no file-type check on this path.
References
- https://wpsec.com/vuln/WPSEC-2026-0042/
- https://plugins.svn.wordpress.org/loco-translate/tags/2.8.9/
- https://wordpress.org/plugins/loco-translate/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS