Loco Translate Cross-Site Request Forgery Vulnerability Allowing Remote Code Execution

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Loco Translate plugin for WordPress, affecting all versions through 2.8.5. The issue arises from inadequate nonce validation in the 'execTemplate' function, enabling unauthenticated attackers to execute arbitrary PHP code on the server. Exploitation involves sending a forged request with a 'template' parameter that includes a php://filter stream wrapper URI, bypassing path validation. This crafted request can trick a site administrator into inadvertently executing the malicious code.

Impact

Successful exploitation allows for remote code execution on the server where WordPress is hosted.

Reproduction

To reproduce this vulnerability, an attacker must first create a forged request that includes a php://filter stream wrapper URI as the 'template' parameter. This request should be sent to a WordPress site with the Loco Translate plugin installed, targeting the 'execTemplate' function. The attacker must then trick an administrator into clicking a link that activates the forged request, such as through a social engineering tactic or by embedding the link in a location where the admin is likely to click it.

Remediation

Users are advised to update the Loco Translate plugin to version 2.8.6 or later, where this vulnerability has been patched.