WordPress Loco Translate Plugin CSRF Leading to RCE

The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on the execTemplate function. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server by supplying a php://filter stream wrapper URI as the 'template' parameter, which bypasses path validation and is passed directly to the include sink in execTemplate() via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Loco Translate plugin for WordPress contains a critical Cross-Site Request Forgery (CSRF) vulnerability in its execTemplate function that allows unauthenticated attackers to execute arbitrary PHP code on vulnerable servers. By exploiting missing nonce validation, an attacker can craft a malicious request that tricks a site administrator into unknowingly triggering the vulnerable function. The attacker supplies a php://filter stream wrapper as the 'template' parameter, which bypasses path validation checks and reaches the include sink directly—converting a CSRF vector into Remote Code Execution (RCE). With a CVSS score of 8.8, this vulnerability affects all versions of Loco Translate up to 2.8.5 and poses an immediate threat to any WordPress installation using this popular translation plugin.

Casky's 322 mapped security skills, powered by Claude AI with extended reasoning, detect this attack pattern across two critical MITRE ATT&CK techniques: TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify suspicious findings including: (1) anomalous POST requests to the wp-admin endpoint lacking valid nonce tokens, (2) template parameter injection attempts containing php:// protocol handlers or stream wrappers, (3) unusual include() or require() function calls with user-controlled input paths, and (4) sudden PHP execution originating from translation plugin directories. The platform's extended reasoning capabilities would correlate these indicators to surface the complete attack chain—from reconnaissance through exploitation—enabling security teams to distinguish legitimate plugin traffic from CSRF-based RCE attempts and rapidly implement compensating controls or apply patches.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15005.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-15005

Casky has 322 skills that investigate the attack patterns behind CVE-2026-15005. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn