The Loco Translate WordPress plugin up to version 2.8.2 contains a path traversal vulnerability in the fsReference AJAX route. Authenticated users with Translator-level access or higher can exploit this flaw to read arbitrary files on the server outside the intended translation directories, excluding wp-config.php. This occurs because the plugin's findSourceFile() method does not properly validate normalized paths containing directory traversal sequences.