CVE-2026-94238: Loco Translate < 2.8.9 - Translator+ Limited File Read via 'path' Parameter

Q: Who can exploit this issue?

An attacker must have a WordPress account that has been granted Loco Translate's translator capability. The issue is not described as exploitable by unauthenticated visitors.

Q: What data could be exposed?

Affected translation file routes can be used to read files of certain types from anywhere on the server, including locations outside the web root. The available information does not identify the specific file types that can be retrieved.

Q: Are installations running version 2.8.9 affected?

No. The issue affects Loco Translate versions before 2.8.9.

Published Oct 3, 2026

Updated

The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate WordPress plugin before 2.8.9's translator capability to retrieve the contents of files of certain types from anywhere on the server, including outside the web root.

Affected Software

1 affected component

Loco Translate Loco Translate WordPress plugin<2.8.9

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Loco Translate WordPress plugin to a version that resolves this vulnerability.
Fixed in 2.8.9

Event History

Oct 3, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must have a WordPress account that has been granted Loco Translate's translator capability. The issue is not described as exploitable by unauthenticated visitors.

What data could be exposed?

Affected translation file routes can be used to read files of certain types from anywhere on the server, including locations outside the web root. The available information does not identify the specific file types that can be retrieved.

Are installations running version 2.8.9 affected?

No. The issue affects Loco Translate versions before 2.8.9.

CVE-2026-94238: Loco Translate < 2.8.9 - Translator+ Limited File Read via 'path' Parameter

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What data could be exposed?

Are installations running version 2.8.9 affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data could be exposed?

Are installations running version 2.8.9 affected?