Loco Translate <= 2.2.1 - Authenticated LFI



Description
WordPress plugin Loco Translate version appears to have an Authenticated LFI Vulnerability under the 'Edit Template' Functionality. 

The following vulnerability can be exploited by any user with access to the plugin (access can range from Admin to Subscriber)

WPScanTeam Note: Was not able to reproduce this issue with any user other than admin. 
Proof of Concept
The following url should yield the contents of (/etc/passwd) where the path parameter was expecting a GetText file but instead receives the payload, and the contents of said file can be viewed under the source tab or the (file-view) functionality under the action parameter. 
 
/wp-admin/admin.php?path=%2Fetc%2Fpasswd&bundle=twentynineteen&domain=twentynineteen&page=loco-theme&action=file-view

Affects Plugin

fixed in version 2.2.2

References

URL https://www.exploit-db.com/exploits/46619

Classification

Type LFI
OWASP Top 10 A1: Injection
CWE CWE-22

Miscellaneous

Original Researcher S4R1N
Submitter Ali S. Ahmad
Submitter Twitter https://twitter.com/S4R1N
Views 4574
Verified No
WPVDB ID 9346

Timeline

Publicly Published 2019-03-27 (over 1 year ago)
Added 2019-06-17 (about 1 year ago)
Last Updated 2019-11-26 (8 months ago)

Our Other Services

Online WordPress Vulnerability Scanner WPScan WordPress Security Plugin