Executive brief
Loco Translate, a popular WordPress plugin used for managing website translations, contains a security flaw that could allow an attacker to take over a website. By tricking a site administrator into clicking a malicious link, an attacker can remotely execute unauthorized code on the web server. This could lead to a total compromise of the website, including the theft of sensitive data or the disruption of services.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Loco Translate plugin for WordPress due to missing or incorrect nonce validation on the execTemplate function. An unauthenticated attacker can exploit this by inducing a site administrator to click a specially crafted link. The exploit utilizes the 'template' parameter to supply a php://filter stream wrapper URI, which bypasses path validation and is passed directly to a PHP include sink. This results in arbitrary PHP code execution on the underlying server. The vulnerability affects all versions up to and including 2.8.5.
Affected products
- timwhitlock Loco Translate up to, and including, 2.8.5
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory
References
- https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.3/src/mvc/AdminController.php
- https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.3/src/mvc/AdminRouter.php
- https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.3/src/mvc/View.php
- https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.3/src/mvc/View.php
- https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.5/src/mvc/AdminController.php
- https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.5/src/mvc/AdminRouter.php
- https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.5/src/mvc/View.php