CVE-2026-94238

MediumCVSS 6.8

Published: 03/10/2026(UTC)Updated: 03/10/2026(UTC)Translated: 03/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

4th percentile - higher than 4% of all known CVEs

Summary

The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read. This allows users granted the translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.

Risk Assessment

An attacker with the translator capability can read sensitive files such as configurations, keys, or credentials, potentially leading to further system compromise. This violates data confidentiality.

Recommendation

Update the Loco Translate plugin to version 2.8.9 or later. Restrict the translator capability to trusted users.

Other vulnerabilities in Loco Translate WordPress plugin

CVE-2026-94239Medium
The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page. This allows users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators.

Original NVD description (English source)

The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS