CVE-2021-24721: Loco Translate < 2.5.4 - Authenticated PHP Code Injection

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-08 · updated 2026-06-17
Weakness: CWE-94

Description

The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations.

Affected products

Loco Translate: before 2.5.4 — fixed in 2.5.4

How to fix

Upgrade to a fixed version: Loco Translate 2.5.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/bc7d4774-fce8-4b0b-8015-8ef4c5b02d38
https://wpscan.com/vulnerability/bc7d4774-fce8-4b0b-8015-8ef4c5b02d38

Get alerted when CVE-2021-24721 or the next vulnerability affects your stack