EUVD-2026-91947
GHSA-m23q-3295-mh2g
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Network-reachable route with low complexity (AV:N/AC:L); the translator capability is a privileged grant so PR:H; reading files outside the web root crosses the app's authority (S:C) yielding C:H with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.
AnalysisAI
Path traversal in Loco Translate WordPress plugin before 2.8.9 (CVSS 6.8) lets authenticated users who hold the plugin's translator capability read certain file types from arbitrary server paths, including outside the web root. Publicly available exploit code exists, but CISA KEV does not list active exploitation; EPSS is 0.16% (4th percentile) and SSVC rates exploitation as none, making this a real-but-not-urgent issue. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated WordPress account that has been granted Loco Translate's 'translator' capability (PR:H); this is not available to anonymous or default low-privileged visitors. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity path traversal (CWE-22) with signals that consistently point to a real-but-not-urgent issue rather than a high-priority emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Loco Translate to 2.8.9 or later; vendor-released patch: 2.8.9. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Loco Translate
View allStored cross-site scripting in the Loco Translate WordPress plugin before 2.8.9 allows an authenticated attacker with th
The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source tran
Remote code execution in the Loco Translate WordPress plugin (all versions up to and including 2.8.5) is reachable throu
Stored XSS in the Loco Translate WordPress plugin (versions up to and including 2.8.7) allows authenticated users holdin
Reflected Cross-Site Scripting in Loco Translate WordPress plugin versions up to 2.8.2 allows unauthenticated attackers
Loco Translate plugin for WordPress versions up to 2.8.2 allows authenticated attackers with Translator-level access to
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today