Loco Translate <= 2.8.8 - Authenticated (Translator+) Path Traversal to Limited File Read via Download Endpoint
- ID
- WPSEC-2026-0043
- Plugin
- Loco Translate (loco-translate)
- Affected
- from 2.6.8 before 2.8.9
- Remediation
- Update to 2.8.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-22
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Loco Translate on WPSec AttackSurface
- Fix released
- Published
Description
The Loco Translate plugin for WordPress is vulnerable to Path Traversal in versions 2.6.8 up to, and including, 2.8.8 via the 'path' parameter of the loco_download AJAX action. When no source text was posted, the endpoint resolved the path against wp-content (accepting ../ sequences and absolute paths) and returned any existing file with a translation-format extension (.po, .pot, .mo, .json or .l10n.php) straight from disk. This makes it possible for authenticated attackers with access to Loco Translate (administrators by default, plus any role granted the loco_admin capability, such as the Translator role) to read arbitrary .json files anywhere the web server can read, such as exported settings or credential files. The bundle configuration download similarly returned any .xml file for bundles configured from a loco.xml file.
References
- https://wpsec.com/vuln/WPSEC-2026-0043/
- https://plugins.svn.wordpress.org/loco-translate/tags/2.8.9/
- https://wordpress.org/plugins/loco-translate/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS