VulnSocial

CVE-2026-15005Disclosure

LOWCVSS 8.8 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on the execTemplate function. This makes it possible for unauthenticated attackers to execute arbitrary PHP code on the server by supplying a php://filter stream wrapper URI as the 'template' parameter, which bypasses path validation and is passed directly to the include sink in execTemplate() via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-352

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-07-16); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-16: 2Mentions · 2026-07-27: 1PoC Mentioned / Linked · 2026-07-27: 1Patch / Workaround · 2026-07-27: 1Technical Details · 2026-07-16: 207-1607-27
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-162
Disclosure2
2026-07-271
Patch1
Full discourse3 posts
  • yousukezan@yousukezan
    Patch

    Loco Translate(翻訳プラグイン)CVE-2026-15005──1クリックでPHP実行、確認と更新手順 https://qiita.com/jiis-sasaki/items/d3d906e45ed0af49b829 #Qiita @sitedock_jpより

    Post summary

    The post announces that the Loco Translate plugin CVE‑2026‑15005 permits one‑click PHP execution, and it provides confirmation steps and guidance for applying the necessary plugin update to remediate the issue.

    000001.3K
    14.5K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-15005 The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect n… https://www.cve.org/CVERecord?id=CVE-2026-15005 ----- Traducción: CVE-2026-15005 El … http://infoflow.cloud`

    Post summary

    The tweet announces CVE-2026-15005 as a CSRF flaw in Loco Translate plugin up through version 2.8.5, referencing the CVE record but providing no patch, exploit, or active exploitation details.

    0000036
    92 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-15005 The Loco Translate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect n… https://www.cve.org/CVERecord?id=CVE-2026-15005

    Post summary

    The note announces that the Loco Translate WordPress plugin is vulnerable to CSRF in all versions up to 2.8.5, with a reference to the CVE record.

    00000649
    57.8K followersView on X

Explore more

Back to dashboard