The Loco Translate plugin for WordPress contains a Cross‑Site Request Forgery flaw in all releases up to and including version 2.8.5. The flaw arises from missing or incorrect nonce validation on the execTemplate function, allowing an unauthenticated attacker to supply a php://filter stream wrapper URL as the 'template' parameter. This URL is passed directly into an include call, which can result in arbitrary PHP code execution on the server. The weakness is classified as CWE‑352.

The vulnerability affects the WordPress Loco Translate plugin developed by Tim Whitlock, specifically every version numbered 2.8.5 or earlier. Any WordPress site that has this plugin installed and active is susceptible, regardless of the rest of the site configuration.

The CVSS base score of 8.8 indicates high severity, while the EPSS score of <1% points to a low probability of exploitation at the present time. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a CSRF attack that requires a site administrator or other privileged user to unknowingly submit the crafted request, such as clicking a malicious link. Because the exploit depends on user interaction, the chance of automated exploitation is low, but the impact on a successful attack is total loss of code execution control over the affected WordPress installation.