CVE-2026-15005: Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter
The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on the execTemplate function. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server by supplying a php://filter stream wrapper URI as the 'template' parameter, which bypasses path validation and is passed directly to the include sink in execTemplate() via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Loco Translateto a version that resolves this vulnerability.Fixed in 2.8.5 - Configuration
Ensure correct nonce validation is implemented for the execTemplate function so forged requests cannot bypass nonce checks.
WordPress Loco Translate (execTemplate) nonce validation = required - Compensating control
Protect the WordPress admin actions used to trigger template execution by adding an external mitigation such as restricting access to the affected endpoint to trusted users/IPs (e.g., via firewall/ACL) and/or adding a WAF rule to block attempts to use php://filter stream wrapper URIs in the template parameter.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15005?
The severity of CVE-2026-15005 is rated high, with a score of 8.8.
How can CVE-2026-15005 be mitigated?
To mitigate CVE-2026-15005, update the Loco Translate plugin to the latest version, which addresses the Cross-Site Request Forgery vulnerability.
What systems are affected by CVE-2026-15005?
CVE-2026-15005 affects all versions of the Loco Translate plugin for WordPress up to and including 2.8.5.
What kind of attack does CVE-2026-15005 enable?
CVE-2026-15005 enables unauthenticated attackers to execute arbitrary PHP code on the server due to missing nonce validation.
Is user interaction required to exploit CVE-2026-15005?
No, user interaction is not required to exploit CVE-2026-15005, making it particularly dangerous.