CVE-2026-15005

HighCVSS 8.8

Published: 16/07/2026(UTC)Updated: 16/07/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 2.8.5. Missing nonce validation in the execTemplate function allows unauthenticated attackers to execute arbitrary PHP code on the server by supplying a php://filter stream wrapper URI as the 'template' parameter, bypassing path validation and leading to code execution.

Risk Assessment

The risk involves remote arbitrary PHP code execution by an unauthenticated attacker, potentially leading to full compromise of the WordPress site, data theft, or lateral movement within the infrastructure.

Recommendation

Immediately update the Loco Translate plugin to the latest available version that includes a fix for the CSRF vulnerability and proper validation of the 'template' parameter.

Other vulnerabilities in Loco Translate

CVE-2026-15066Medium
The Loco Translate plugin for WordPress up to version 2.8.7 is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments. Insufficient input sanitization and output escaping allow authenticated attackers with translator-level access to inject arbitrary web scripts that execute when a user accesses an injected page.

Original NVD description (English source)

The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on the execTemplate function. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server by supplying a php://filter stream wrapper URI as the 'template' parameter, which bypasses path validation and is passed directly to the include sink in execTemplate() via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.