CVE-2026-94238

MEDIUMCVSS 6.8

Description

The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.

Timeline

Published:October 3rd, 2026 6:16 AM

Last modified:October 3rd, 2026 4:16 PM

CVSS Scoring

CVSS v3: 6.8 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Weaknesses (CWE)

CWE-22

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/76d339bf-094c-459d-9f6c-caeda5e97892/

Source: NIST NVD · Data may lag official sources by up to one minute