The Loco Translate WordPress plugin before version 2.8.9 does not validate the file path used by its translation file routes. A user with translator privileges can supply a path parameter that points to any readable file on the server. The plugin then opens and returns the contents of that file, enabling the extraction of information such as configuration data or credentials. This flaw constitutes a file‑read vulnerability; it does not allow code execution or modification of files.

WordPress installations that have the Loco Translate plugin installed with a version earlier than 2.8.9. The vulnerability is exercised when a user with the translator role accesses the plugin’s translation file route and supplies a path that points inside or outside the web root. Sites that lack the plugin or run a newer version are not affected.

The EPSS score of 0.00157 (<1%) indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. The flaw requires the attacker to possess translator capabilities, which typically ties to authenticated users. The risk remains moderate for sites that expose the translator role to untrusted users; once the role is obtained, any readable file can be retrieved, resulting in a confidentiality breach that could be leveraged for future attacks. The CVSS score of 6.8 indicates moderate severity; the low EPSS mitigates the overall threat relative to actively exploited vulnerabilities.