Cross-Site Request Forgery Vulnerability in Loco Translate for WordPress

CVE-2026-15005

What is CVE-2026-15005?

The Loco Translate plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit Cross-Site Request Forgery due to inadequate nonce validation in the execTemplate function. This flaw enables attackers to inject and execute arbitrary PHP code on the server, which can occur if they successfully trick an administrator into executing a malicious request, such as clicking a link. The vulnerability affects all versions up to and including 2.8.5 and poses significant risks if left unaddressed.

References