Quran multilanguage Text & Audio < 3.0.4 - Unauthenticated Path Traversal to Arbitrary .txt File Read via 'lang' Parameter
- ID
- WPSEC-2026-0373
- Plugin
- Quran multilanguage Text & Audio (quran-text-multilanguage)
- Affected
- from 3.0.0 before 3.0.4
- Remediation
- Update to 3.0.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Quran multilanguage Text & Audio on WPSec AttackSurface
- Fix released
- Published
Description
The Quran multilanguage Text & Audio plugin for WordPress is vulnerable to Path Traversal via the 'lang' parameter in versions 3.0.0 up to, and including, 3.0.3. This is due to the parameter, accepted by the plugin's AJAX handlers (available to unauthenticated users) and by the URL of pages containing the [quran] shortcode, being appended to a local translation file path without validation against the supported languages. This makes it possible for unauthenticated attackers to read the contents of arbitrary .txt files on the server, which are printed into the response and may contain sensitive information.
References
- https://wpsec.com/vuln/WPSEC-2026-0373/
- https://plugins.svn.wordpress.org/quran-text-multilanguage/tags/3.0.4/
- https://wordpress.org/plugins/quran-text-multilanguage/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS