What the vulnerability does
01Description
The Loco Translate plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.8.2 via the `fsReference` AJAX route. This is due to the `findSourceFile()` method normalizing user-supplied `ref` paths containing `../` directory traversal sequences without validating that the resolved path remains within the intended bundle or content directory. This makes it possible for authenticated attackers, with Translator-level access and above (custom `loco_admin` capability required, granted to the `translator` role and administrators by default), to read arbitrary `.php`, `.js`, `.json`, and `.twig` files from the server filesystem outside the intended translation directory. Files named wp-config.php are excluded.
Explanation of Vulnerability in Simple Terms
02Summary
Loco Translate versions up to 2.8.2 contain a path traversal vulnerability that allows high-privilege users to read files outside the intended directory. An attacker with administrator or translator access can craft requests to access sensitive files on the server. The vulnerability requires high-level privileges and does not allow file modification or system disruption.
What an attacker can do
03Attacker Capabilities
Read arbitrary files on the server outside the plugin's intended directory.
Potential impact on your site
04Site Impact
Administrators or translators with malicious intent can access sensitive configuration files, database credentials, or other private data.
Conditions required to exploit
05Prerequisites
Attacker must have high-level privileges (administrator or translator role) on the site.
Key dates
06Disclosure timeline
May 5, 2026
CVE published
May 6, 2026
Record updated
