# Jock On Air Now (JOAN) <= 6.1.3 - Unauthenticated Limited Path Traversal via 'joan_visitor_locale' Cookie

- **ID:** WPSEC-2026-1419
- **Plugin:** Jock On Air Now (JOAN) (`joan`), https://wordpress.org/plugins/joan/
- **Affected versions:** from 6.0.9 before 6.1.4
- **Fixed in:** 6.1.4 (Update to 6.1.4 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/joan
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1419/

## Description

The Jock On Air Now (JOAN) plugin for WordPress is vulnerable to Limited Path Traversal via the 'joan_visitor_locale' cookie in all versions up to, and including, 6.1.3. This is due to the cookie value being passed only through sanitize_text_field(), without being restricted to a well-formed locale code or to a locale the plugin ships. The value is then returned as the site locale on front-end requests and used to build the path of the translation file to load. This makes it possible for unauthenticated attackers to use directory traversal sequences to make WordPress load translation files (.mo / .l10n.php) from other places on the server.

## References

- https://wpsec.com/vuln/WPSEC-2026-1419/
- https://plugins.svn.wordpress.org/joan/tags/6.1.4/
- https://wordpress.org/plugins/joan/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1419/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.