We don’t know why developers publicly publish details of security changes in their WordPress plugins before they are making them available to users, but that keeps happening. That has occurred with the plugin Loco Translate. The Subversion commit message for the latest changes to the plugin is:

Fixed double file extension vulnerability

That is part of version 2.5.5, but they haven’t made that available to those using the plugin.

That involves further change from a security change made in version 2.4.4, which has been credited to Tomi Ashari.

The original change restricted renaming translation files so they could only have an extension of .po or .pot. Before that they could be renamed to end with .php and the PHP code in them could run. The second change restricts files from having multiple extensions, say .php.pot, which is some server configurations, would still be treated as PHP files and have the code run.

By default only Administrators can access the plugin’s functionality and exploit this, but the plugin’s setting allow providing lower level users with access.

Proof of Concept

From the Relocate tab of a translation file in the plugin’s editor, clicked Advanced, and then you can change the file extension.