The Loco Translate WordPress plugin before version 2.8.9 does not validate the file path used by its translation file routes. A user with translator privileges can supply a path parameter that points to any readable file on the server. The plugin then opens and returns the contents of that file, enabling the extraction of information such as configuration data or credentials. This flaw constitutes a file‑read vulnerability; it does not allow code execution or modification of files.

WordPress installations that have the Loco Translate plugin installed with a version earlier than 2.8.9. The vulnerability is exercised when a user with the translator role accesses the plugin’s translation file route and supplies a path that points inside or outside the web root. Sites that lack the plugin or run a newer version are not affected.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that exploit activity has not been observed or reported. The flaw requires the attacker to possess translator capabilities, which typically ties to authenticated users. The risk is therefore moderate for sites that expose the translator role to untrusted users; once the role is obtained, any readable file can be retrieved, resulting in a confidentiality breach that could be leveraged for future attacks. No CVSS score is disclosed; the lack of known exploitation suggests a lower threat level compared to actively exploited vulnerabilities.