CVE-2026-94238
Loco Translate < 2.8.9 - Translator+ Limited File Read via 'path' Parameter
- State
- Published
- Severity
- 6.8 Medium
- Published
- Oct 3, 2026
- Updated
- Oct 3, 2026
- Reserved
- Sep 21, 2026
Description
The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.8 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
Loco TranslateUnknown |
|
References
- https://wpscan.com/vulnerability/76d339bf-094c-459d-9f6c-caeda5e97892/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.