CVE-2026-1921

The Loco Translate plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.8.2 via the `fsReference` AJAX route. This is due to the `findSourceFile()` method normalizing user-supplied `ref` paths containing `../` directory traversal sequences without validating that the resolved path remains within the intended bundle or content directory. This makes it possible for authenticated attackers, with Translator-level access and above (custom `loco_admin` capability required, granted to the `translator` role and administrators by default), to read arbitrary `.php`, `.js`, `.json`, and `.twig` files from the server filesystem outside the intended translation directory. Files named wp-config.php are excluded.

• CWE-22

• https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.1/src/ajax/FsReferenceController.php#L12
• https://plugins.trac.wordpress.org/browser/loco-translate/tags/2.8.1/src/ajax/FsReferenceController.php#L92
• https://plugins.trac.wordpress.org/browser/loco-translate/trunk/src/ajax/FsReferenceController.php#L12
• https://plugins.trac.wordpress.org/browser/loco-translate/trunk/src/ajax/FsReferenceController.php#L92
• https://plugins.trac.wordpress.org/changeset/3482475/loco-translate/trunk/tpl/admin/config/version.php
• https://plugins.trac.wordpress.org/changeset?old_path=%2Floco-translate/tags/2.8.2&new_path=%2Floco-translate/tags/2.8.3
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f9ff3058-a08c-40ed-b756-81e703b2277a?source=cve

Published

May 5, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19196A vulnerability was found in SourceCodester Photo Share Webs…7.3
• CVE-2026-1920The Booking Calendar for Appointments and Service Businesses…5.3
• CVE-2026-19206A security flaw has been discovered in MZ Automation libiec6…5.3
• CVE-2026-19207A security vulnerability has been detected in PHPGurukul Com…2.4
• CVE-2026-19208A vulnerability was detected in WonderTrader up to 0.9.9. Im…3.7
• CVE-2026-19209A flaw has been found in SourceCodester Photo Share Website …3.5
• CVE-2026-19210A vulnerability has been found in SourceCodester Photo Share…6.3
• CVE-2026-19211A vulnerability was found in SourceCodester Photo Share Webs…7.3
• CVE-2026-19212A vulnerability was determined in WonderTrader up to 0.9.9. …4.3
• CVE-2026-19213A vulnerability was identified in WonderTrader up to 0.9.9. …4.3
• CVE-2026-19217The Royal Addons for Elementor WordPress plugin before 1.7.…
• CVE-2026-1922The The Events Calendar Shortcode & Block plugin for WordPre…6.4