CVE-2026-15005 is a CSRF vulnerability in the Loco Translate WordPress plugin (timwhitlock) affecting all versions up to 2.8.5. The vulnerability is due to missing or incorrect nonce validation on the execTemplate function. This allows an unauthenticated attacker to supply a crafted 'template' parameter using a php://filter stream wrapper URI, bypassing path validation and leading to arbitrary PHP code execution via the include sink in execTemplate(). Exploitation requires tricking a site administrator into performing an action such as clicking a malicious link.

Successful exploitation can lead to arbitrary PHP code execution on the server, resulting in full compromise of the affected WordPress site. The vulnerability allows an unauthenticated attacker to execute code with the privileges of the site administrator if the administrator is tricked into performing the malicious action. This impacts confidentiality, integrity, and availability of the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should avoid clicking untrusted links and consider disabling or removing the Loco Translate plugin if possible. Monitor official vendor channels for updates and apply patches promptly once released.