Jock On Air Now (JOAN) <= 6.1.3 - Unauthenticated Limited Path Traversal via 'joan_visitor_locale' Cookie
- ID
- WPSEC-2026-1419
- Plugin
- Jock On Air Now (JOAN) (joan)
- Affected
- from 6.0.9 before 6.1.4
- Remediation
- Update to 6.1.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-22
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- Jock On Air Now (JOAN) on WPSec AttackSurface
- Fix released
- Published
Description
The Jock On Air Now (JOAN) plugin for WordPress is vulnerable to Limited Path Traversal via the 'joan_visitor_locale' cookie in all versions up to, and including, 6.1.3. This is due to the cookie value being passed only through sanitize_text_field(), without being restricted to a well-formed locale code or to a locale the plugin ships. The value is then returned as the site locale on front-end requests and used to build the path of the translation file to load. This makes it possible for unauthenticated attackers to use directory traversal sequences to make WordPress load translation files (.mo / .l10n.php) from other places on the server.
References
- https://wpsec.com/vuln/WPSEC-2026-1419/
- https://plugins.svn.wordpress.org/joan/tags/6.1.4/
- https://wordpress.org/plugins/joan/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS