CVE-2026-94238 in Loco Translate Plugin
Summary
by MITRE • 10/03/2026
The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified in versions of the Loco Translate WordPress plugin prior to release 2.8.9 represents a critical Local File Inclusion (LFI) flaw rooted in insufficient input validation and path traversal weaknesses within the application's translation file handling mechanisms. This security defect allows authenticated users possessing the translator capability, which is typically granted to editors or administrators depending on site configuration, to exploit an unrestricted file read operation. The core technical issue lies in how the plugin processes user-supplied parameters intended for specifying translation files; rather than strictly validating these inputs against a whitelist of expected paths within the WordPress installation directory structure, the application accepts arbitrary file path strings without adequate sanitization or boundary checks.
From a technical perspective, this flaw enables an attacker to manipulate the input parameter to include directory traversal sequences such as dot-dot-slash characters. By constructing specific requests that reference absolute paths on the underlying server operating system, the vulnerable code executes a read operation that bypasses the intended scope of the plugin's functionality. This lack of restriction means that the application does not verify whether the requested file resides within the expected web root or WordPress directories. Consequently, an attacker can navigate up the directory hierarchy to access sensitive configuration files, database credentials stored in wp-config.php, server environment variables, and other critical system resources located outside the public-facing web space where such data is typically protected from direct HTTP access by standard web server configurations like Apache or Nginx restrictions on hidden directories.
The operational impact of this vulnerability is severe, as it effectively grants an attacker read-only access to a significant portion of the target server's file system. While the initial vector requires authentication and specific user privileges, these roles are often attainable through credential theft, social engineering, or exploitation of other lower-severity vulnerabilities within the WordPress ecosystem. Once exploited, the ability to exfiltrate sensitive files can lead to full site compromise if database credentials are retrieved, allowing for further attacks such as SQL injection or remote code execution using uploaded shell scripts found in temporary directories. Furthermore, access to server configuration files may reveal internal network topology, API keys, and other secrets that facilitate lateral movement within a compromised environment.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as the application fails to enforce strict boundaries on file path inputs. It also maps to MITRE ATT&CK technique T1083: File and Directory Discovery, where adversaries use system commands or scripts to explore the local environment for sensitive information. The exploitation method is consistent with CWE-95: Improper Neutralization of Special Elements used in a Command (Command Injection) variants related to path traversal, although it manifests specifically as an unauthorized file read rather than command execution.
To mitigate this risk, organizations must immediately update the Loco Translate plugin to version 2.8.9 or later, where these input validation checks have been implemented and tested by the developers. In environments where immediate patching is not feasible due to compatibility concerns with other plugins or custom code, administrators should consider restricting user roles that possess translation capabilities to only those who absolutely require them for operational purposes. Additionally, implementing Web Application Firewall rules that detect common path traversal patterns in request parameters can provide a layer of defense-in-depth by blocking malicious requests before they reach the application logic. Regular auditing of installed plugins and maintaining strict version control over third-party extensions are essential practices to prevent exposure to such known vulnerabilities in widely used WordPress ecosystems.