CVE-2026-15005: Loco Translate WordPress CSRF Vulnerability

CVE-2026-15005 Overview

CVE-2026-15005 is a Cross-Site Request Forgery (CSRF) vulnerability in the Loco Translate plugin for WordPress affecting all versions up to and including 2.8.5. The flaw stems from missing or incorrect nonce validation on the execTemplate function. An unauthenticated attacker can execute arbitrary PHP code on a vulnerable server by supplying a php://filter stream wrapper URI as the template parameter. This payload bypasses path validation and is passed directly to a PHP include sink. Exploitation requires tricking a site administrator into clicking a malicious link or visiting an attacker-controlled page. The vulnerability is classified under [CWE-352] (Cross-Site Request Forgery).

Critical Impact
Successful exploitation yields arbitrary PHP code execution in the WordPress runtime, enabling full site takeover, credential theft, and lateral movement into the hosting environment.

Affected Products

Loco Translate plugin for WordPress — all versions up to and including 2.8.5
WordPress installations running Loco Translate 2.8.3
WordPress installations running Loco Translate 2.8.5

Discovery Timeline

2026-07-16 - CVE-2026-15005 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-15005

Vulnerability Analysis

The vulnerability resides in the Loco Translate plugin's execTemplate() function within src/mvc/View.php. The plugin exposes an administrative route through AdminRouter.php and AdminController.php that ultimately calls execTemplate() with a caller-supplied template parameter. Because the request handler fails to validate a WordPress nonce, any HTTP request delivered under an authenticated administrator's session is accepted as legitimate.

The template parameter is passed through insufficient path validation and reaches a PHP include statement inside execTemplate(). When an attacker supplies a php://filter stream wrapper URI, PHP resolves the wrapper and evaluates attacker-controlled content as PHP code. This transforms a CSRF issue into unauthenticated remote code execution when combined with administrator interaction.

Root Cause

The root cause is the absence of nonce verification on a privileged administrative action. WordPress relies on nonces to bind state-changing requests to an authenticated session. The execTemplate code path skips this check and additionally trusts the template input for use in a file inclusion sink, compounding the CSRF weakness with a Local File Inclusion primitive.

Attack Vector

Exploitation proceeds over the network and requires user interaction from a logged-in administrator. The attacker crafts a malicious page or link that issues a forged request to the target WordPress site containing a template parameter set to a php://filter payload. When the administrator visits the attacker's page, the browser submits the request with valid session cookies. The server processes the include, executing attacker-supplied PHP.

The vulnerability mechanics are documented in the plugin's source at src/mvc/AdminController.php, src/mvc/AdminRouter.php, and src/mvc/View.php. See the Wordfence Vulnerability Report and the WordPress Loco Translate Changeset for the specific code locations and fix.

Detection Methods for CVE-2026-15005

Indicators of Compromise

HTTP requests to WordPress admin endpoints containing a template parameter with values beginning php://filter/, php://input, data://, or other PHP stream wrappers.
Referer headers on Loco Translate admin actions that originate from external, untrusted domains rather than the WordPress admin dashboard.
Unexpected PHP files, backdoors, or modified wp-config.php timestamps following administrator sessions that interacted with Loco Translate.
Outbound connections from the web server process to unknown hosts shortly after Loco Translate admin activity.

Detection Strategies

Inspect web server access logs for query strings containing php:// or base64-encoded filter chains such as convert.base64-decode targeting Loco Translate routes.
Alert on any Loco Translate administrative request lacking a valid _wpnonce parameter or with a Referer outside the site's own domain.
Monitor file integrity on the WordPress installation, especially wp-content/plugins, wp-content/mu-plugins, and theme directories, for new or modified PHP files.

Monitoring Recommendations

Enable verbose logging on the WordPress admin interface and forward logs to a centralized platform for correlation of CSRF and LFI patterns.
Track administrator browsing behavior and flag admin sessions that follow inbound links from external referrers immediately before Loco Translate requests.
Baseline the PHP process's expected child processes and network egress, and alert on deviations that indicate webshell execution.

How to Mitigate CVE-2026-15005

Immediate Actions Required

Update Loco Translate to a version later than 2.8.5 that includes the fix referenced in the plugin changeset. If no patched release is available in your channel, deactivate and remove the plugin.
Force a logout of all administrator sessions and rotate WordPress administrator credentials and any secrets stored in wp-config.php.
Audit the WordPress filesystem for unauthorized PHP files or modifications introduced during the exposure window.
Restrict administrator access to trusted networks and require multi-factor authentication for all privileged WordPress accounts.

Patch Information

The fix is tracked in the WordPress Loco Translate Changeset, which addresses the missing nonce validation on the execTemplate function and hardens template path handling. Administrators should apply the vendor-supplied update through the WordPress plugin updater and confirm the installed version is greater than 2.8.5.

Workarounds

Disable the Loco Translate plugin until the patched version is deployed across all WordPress sites in the environment.
Deploy a Web Application Firewall (WAF) rule that blocks requests to Loco Translate endpoints containing php://, data://, or other stream wrapper schemes in the template parameter.
Set the PHP allow_url_include directive to Off in php.ini to prevent stream wrapper abuse in include statements.
Educate administrators to avoid clicking untrusted links while authenticated to the WordPress admin dashboard, and use a separate browser profile for administrative work.

bash

# Configuration example: disable URL includes in PHP to blunt php:// filter abuse
# Edit php.ini and set:
allow_url_include = Off
allow_url_fopen = Off

# Verify the setting is applied
php -i | grep -E 'allow_url_include|allow_url_fopen'

# Restart the web server after changes
sudo systemctl restart php-fpm
sudo systemctl restart nginx