Description

WordPress Plugin Loco Translate is prone to a local file inclusion vulnerability because it fails to sufficiently verify user-supplied input. Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks. WordPress Plugin Loco Translate version 2.2.1 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 2.2.2 or latest

References

https://www.exploit-db.com/exploits/46619

https://packetstormsecurity.com/files/152295/WordPress-Loco-Translate-2.2.1-Local-File-Inclusion.html

https://plugins.svn.wordpress.org/loco-translate/trunk/readme.txt

Related Vulnerabilities

Python Uncontrolled Search Path Element Vulnerability (CVE-2017-20052)

Apache Tomcat Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2005-4838)

WP Socializer-Simple & Easy Social Media Share Icons Cross-Site Scripting (2.4.2)

Joomla! Core 1.6.x Information Disclosure (1.6.0 - 1.6.3)

Profile Builder-User Profile & User Registration Forms Multiple Unspecified Vulnerabilities (2.5.7)

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Tags

Missing Update File Inclusion