EUVD-2026-44898
GHSA-5339-rrvx-g5v3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable CSRF needing no attacker privileges (PR:N) but requiring an admin to click a link (UI:R); resulting PHP execution yields full C/I/A impact within the same scope.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on the execTemplate function. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server by supplying a php://filter stream wrapper URI as the 'template' parameter, which bypasses path validation and is passed directly to the include sink in execTemplate() via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Remote code execution in the Loco Translate WordPress plugin (all versions up to and including 2.8.5) is reachable through a Cross-Site Request Forgery flaw in the execTemplate function, where missing nonce validation lets an unauthenticated attacker who tricks a logged-in administrator into clicking a crafted link supply a php://filter stream wrapper as the 'template' parameter, bypassing path validation and reaching a PHP include sink to execute arbitrary code. The chain converts a classic CSRF (CWE-352) into full server compromise, carrying CVSS 8.8 (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The plugin is Loco Translate, a WordPress translation-management plugin (CPE cpe:2.3:a:timwhitlock:loco_translate). The root cause is CWE-352 (Cross-Site Request Forgery): the AdminController/AdminRouter request path (AdminController.php#L38, AdminRouter.php#L128) dispatches to View.php's execTemplate() (View.php#L273-L274) without validating a WordPress nonce, so a request's authenticity is never verified. The exploit primitive is a PHP local file inclusion escalation: the 'template' parameter is passed to an include() sink, and by using PHP's php://filter stream wrapper (e.g. chaining conversion filters) an attacker can smuggle attacker-controlled data past the intended path checks and have it interpreted as PHP, turning file inclusion into arbitrary code execution. In effect two weaknesses compose - the CSRF removes the authentication/intent barrier, and the unsafe include enables code execution.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the WordPress.org changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3603894%40loco-translate&new=3603894%40loco-translate contains the corrective commit, but an exact tagged release number beyond 2.8.5 was not provided in the input, so administrators should update Loco Translate to the latest available version above 2.8.5 via the WordPress plugin updater and confirm the fix note in the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/241d7a82-5fa5-40e3-9336-823644ca17f0?source=cve). If immediate patching is not possible, deactivate the Loco Translate plugin until updated (trade-off: translation editing is unavailable), and reduce CSRF exposure by having administrators avoid clicking untrusted links while authenticated to wp-admin and by using a WAF rule to block requests to the Loco Translate admin action carrying php:// or php://filter in the 'template' parameter (trade-off: pattern-based blocking can be bypassed by encoding and is not a substitute for the code fix). Because the primitive abuses php:// stream wrappers, setting allow_url_include=Off (default) and restricting PHP stream wrappers where feasible narrows but does not eliminate php://filter-based inclusion.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today