What is the CVSS score of CVE-2026-1921?

CVE-2026-1921 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Loco Translate CVE-2026-1921

EUVD-2026-27169 MEDIUM

Path Traversal (CWE-22)

2026-05-05 Wordfence

PHP WordPress Path Traversal

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 03:31 vuln.today

DescriptionCVE.org

The Loco Translate plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.8.2 via the fsReference AJAX route. This is due to the findSourceFile() method normalizing user-supplied ref paths containing ../ directory traversal sequences without validating that the resolved path remains within the intended bundle or content directory. This makes it possible for authenticated attackers, with Translator-level access and above (custom loco_admin capability required, granted to the translator role and administrators by default), to read arbitrary .php, .js, .json, and .twig files from the server filesystem outside the intended translation directory. Files named wp-config.php are excluded.

AnalysisAI

Loco Translate plugin for WordPress versions up to 2.8.2 allows authenticated attackers with Translator-level access to read arbitrary files outside the intended translation directory via path traversal in the fsReference AJAX endpoint. The vulnerability exploits insufficient validation of directory traversal sequences (../) in the findSourceFile() method, enabling disclosure of sensitive .php, .js, .json, and .twig files including wp-config.php-adjacent files. No public exploit code has been identified at time of analysis, and the attack requires administrative capability assignment (loco_admin capability) granted to translators by default.

Technical ContextAI

The vulnerability resides in the FsReferenceController.php AJAX route handler, specifically the findSourceFile() method which processes user-supplied ref parameters. The method normalizes paths containing ../ sequences but fails to validate that the resolved file path remains within the designated bundle or content directory boundary. This is a classic Path Traversal (CWE-22) vulnerability where inadequate input validation allows an attacker to access files outside the intended application namespace. The fsReference AJAX endpoint is accessible to authenticated users with the loco_admin custom capability, which is granted to the translator role and administrators by default in WordPress. The plugin's file reading mechanism does not properly implement allowlist-based path validation or restrict access to parent directories above the translation working directory.

RemediationAI

Update Loco Translate to version 2.8.3 or later, which includes path validation fixes in the findSourceFile() method to prevent directory traversal. Apply the patch from the plugin repository at https://plugins.trac.wordpress.org/changeset?old_path=%2Floco-translate/tags/2.8.2&new_path=%2Floco-translate/tags/2.8.3. As an interim workaround before patching, restrict the loco_admin capability to site administrators only and remove it from the translator role using capability management plugins or code (e.g., remove_cap('translator', 'loco_admin')). Alternatively, disable the Loco Translate plugin entirely on sites where the AJAX fsReference endpoint is not actively used for translation workflows. Additionally, implement file access logging and monitoring for the /wp-admin/admin-ajax.php?action=loco_fsReference endpoint to detect exploitation attempts targeting parent directory access patterns. Monitor for requests containing ../ sequences in the ref parameter.