The Loco Translate plugin for WordPress versions up to 2.8.2 contains a path traversal vulnerability (CWE-22) in the fsReference AJAX route. The findSourceFile() method normalizes user-supplied paths but fails to ensure the resolved path remains within the intended directory, allowing authenticated users with the custom loco_admin capability (typically Translator role and administrators) to read arbitrary .php, .js, .json, and .twig files outside the translation directory. The vulnerability excludes wp-config.php files. No patch or official remediation level has been published as of the data provided.

An authenticated attacker with Translator-level or higher privileges can read arbitrary files on the server filesystem outside the intended translation directory. This can lead to unauthorized disclosure of sensitive source code or configuration files (except wp-config.php). There is no indication of integrity or availability impact. The vulnerability has a medium severity rating with a CVSS score of 4.9.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Translator-level access to trusted users only, as exploitation requires authenticated access with the loco_admin capability. Monitor for updates from the vendor regarding official patches or mitigations.