CVE-2026-1921

A security flaw exists in Loco Translate plugin versions up to 2.8.2, which allows attackers with Translator-level access or higher to read unauthorized files on the server. This is due to a failure to properly validate user-input paths when resolving file references through the `fsReference` AJAX route. As a result, malicious users can access sensitive files such as PHP scripts and configuration data outside of designated translation directories.

Based on public CVE data (MITRE/NVD).