WordPress Plugin Vulnerabilities
Loco Translate < 2.2.2 - Authenticated LFI
Description
WordPress plugin Loco Translate version appears to have an Authenticated LFI Vulnerability under the 'Edit Template' Functionality.
The following vulnerability can be exploited by any user with access to the plugin (access can range from Admin to Subscriber)
WPScanTeam Note: Was not able to reproduce this issue with any user other than admin.
Proof of Concept
The following url should yield the contents of (/etc/passwd) where the path parameter was expecting a GetText file but instead receives the payload, and the contents of said file can be viewed under the source tab or the (file-view) functionality under the action parameter. /wp-admin/admin.php?path=%2Fetc%2Fpasswd&bundle=twentynineteen&domain=twentynineteen&page=loco-theme&action=file-view
Affects Plugins
References
Exploitdb
Classification
Type
LFI
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
S4R1N
Submitter
Ali S. Ahmad
Submitter twitter
Verified
No
WPVDB ID
Timeline
Publicly Published
2019-03-27 (about 5 years ago)
Added
2019-06-17 (about 4 years ago)
Last Updated
2020-12-17 (about 3 years ago)