Path Traversal Vulnerability in Loco Translate Plugin for WordPress

CVE-2026-1921

What is CVE-2026-1921?

The Loco Translate plugin for WordPress suffers from a Path Traversal vulnerability that affects versions up to and including 2.8.2. This flaw arises from the findSourceFile() method, which improperly handles user-supplied ref paths containing directory traversal sequences. Authenticated users with Translator-level access can exploit this vulnerability to access arbitrary files on the server, potentially exposing sensitive data. Although it is designed to limit access to the translation directory, incorrect path normalization allows attackers to bypass these restrictions, thereby increasing the risk of data leaks.

References