CVE-2021-24721 | BDVDB-2026-163939 Detail

Loco Translate

Description#

The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-94 Improper Control of Generation of Code ('Code Injection')

References#

https://wpscan.com/vulnerability/bc7d4774-fce8-4b0b-8015-8ef4c5b02d38

Exploit#

No public exploit known

History#

Version 12021-11-08Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.