CVE-2026-94238: Loco Translate Path Traversal Vulnerability

CVE-2026-94238 Overview

CVE-2026-94238 is a path traversal vulnerability [CWE-22] in the Loco Translate WordPress plugin versions prior to 2.8.9. The plugin fails to restrict which file paths its translation file routes will read. Users granted the plugin's translator capability can retrieve the contents of files of certain types from anywhere on the server, including locations outside the web root. The flaw affects WordPress sites that delegate translation duties to lower-privileged accounts and expands those accounts' effective filesystem access well beyond intended boundaries.

Critical Impact
Authenticated users with the translator capability can read arbitrary files of specific types from the underlying server, exposing configuration data, credentials, and system files.

Affected Products

Loco Translate WordPress plugin versions prior to 2.8.9
WordPress installations assigning the translator capability to non-administrator roles
Multi-site WordPress deployments using Loco Translate for localization

Discovery Timeline

2026-10-03 - CVE-2026-94238 published to the National Vulnerability Database (NVD)
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-94238

Vulnerability Analysis

The Loco Translate plugin exposes routes that read translation files (.po, .mo, .pot) from the filesystem. In versions before 2.8.9, these routes accept file path parameters without validating that the resolved path remains within approved translation directories. An attacker holding the translator capability can supply traversal sequences and request files located anywhere the PHP process can read. The disclosed content is returned through the plugin's file-handling response, giving the attacker a reliable read primitive against the host.

The issue has network-reachable attack surface because the vulnerable endpoints are standard WordPress admin requests. Exploitation requires authentication at the translator level, which is lower than administrator and is often delegated to contributors or external localization staff. The flaw does not permit writing or executing code directly, but file disclosure frequently enables follow-on compromise.

Root Cause

The root cause is missing path canonicalization and whitelist enforcement in the plugin's translation file routing logic. The code trusts user-supplied path components when constructing filesystem reads, allowing directory traversal sequences to escape the intended translations directory. This maps to [CWE-22]: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

An authenticated user with the Loco Translate translator capability sends crafted requests to the plugin's translation file endpoints. The attacker manipulates the path parameter to reference files such as wp-config.php, /etc/passwd, or private key material. The plugin resolves the manipulated path and returns the file contents. Attackers chain the disclosed credentials into database access, administrator takeover, or lateral movement across the hosting environment. Refer to the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-94238

Indicators of Compromise

Requests to Loco Translate admin-ajax or admin page endpoints containing ../ sequences or absolute path parameters
Translator-capability accounts accessing translation file routes for paths outside wp-content/languages
Unexpected reads of sensitive files such as wp-config.php, SSH keys, or environment files by the PHP worker process
Spikes in translation file requests from a single authenticated session

Detection Strategies

Inspect web server logs for Loco Translate request parameters that reference directories above the plugin's language paths
Correlate WordPress user activity logs with filesystem access events to identify translator accounts reading unusual files
Deploy web application firewall rules that reject traversal patterns in Loco Translate request parameters

Monitoring Recommendations

Enable PHP open_basedir logging to flag reads outside the WordPress document root
Monitor for new or modified translator-role accounts and audit their activity
Alert on repeated 200 responses from Loco Translate endpoints returning non-translation file content types

How to Mitigate CVE-2026-94238

Immediate Actions Required

Upgrade the Loco Translate plugin to version 2.8.9 or later on every WordPress site
Audit all accounts holding the translator capability and revoke access from untrusted users
Rotate any credentials, API keys, or secrets stored in files readable by the web server if compromise is suspected

Patch Information

The vendor addressed the issue in Loco Translate 2.8.9 by restricting the file paths accepted by the translation file routes. Administrators should install the update through the WordPress plugin manager or by replacing the plugin directory with the fixed release. Review the WPScan Vulnerability Report for the authoritative advisory.

Workarounds

Temporarily deactivate the Loco Translate plugin until the patched version is deployed
Remove the translator capability from all non-administrator roles using a role management plugin
Apply a web application firewall rule that blocks path traversal sequences in requests to wp-admin pages tied to Loco Translate

bash

# Configuration example
# Restrict PHP filesystem access to the WordPress document root
php_admin_value open_basedir "/var/www/html:/tmp"

# Example WAF pattern to block traversal in Loco Translate requests
SecRule REQUEST_URI "@contains page=loco" \
  "chain,id:1009423,phase:2,deny,status:403,msg:'Loco Translate path traversal attempt'"
  SecRule ARGS "@rx \.\./|/etc/|wp-config\.php" "t:none,t:urlDecode"