{
 "id": "WPSEC-2026-1419",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1419/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1419/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1419/index.md",
 "title": "Jock On Air Now (JOAN) <= 6.1.3 - Unauthenticated Limited Path Traversal via 'joan_visitor_locale' Cookie",
 "description": "The Jock On Air Now (JOAN) plugin for WordPress is vulnerable to Limited Path Traversal via the 'joan_visitor_locale' cookie in all versions up to, and including, 6.1.3. This is due to the cookie value being passed only through sanitize_text_field(), without being restricted to a well-formed locale code or to a locale the plugin ships. The value is then returned as the site locale on front-end requests and used to build the path of the translation file to load. This makes it possible for unauthenticated attackers to use directory traversal sequences to make WordPress load translation files (.mo / .l10n.php) from other places on the server.",
 "plugin": {
  "slug": "joan",
  "name": "Jock On Air Now (JOAN)",
  "full_name": "Jock On Air Now (JOAN)",
  "wordpress_org": "https://wordpress.org/plugins/joan/",
  "advisories_url": "https://wpsec.com/vuln/plugin/joan/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/joan"
 },
 "type": "TRAVERSAL",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "6.0.9",
    "from_inclusive": true,
    "to": "6.1.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 6.0.9 before 6.1.4"
  ]
 },
 "introduced_in": "6.0.9",
 "fixed_in": "6.1.4",
 "remediation": "Update to 6.1.4 or later.",
 "fix_released": "2026-10-20T21:32:42+00:00",
 "published": "2026-10-21T21:41:50+00:00",
 "updated": "2026-10-21T10:35:38.306698+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1419/",
  "https://plugins.svn.wordpress.org/joan/tags/6.1.4/",
  "https://wordpress.org/plugins/joan/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/joan",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}