Loco Translate < 2.8.3 - Translator+ Path Traversal to Limited File Read via 'ref' Parameter

Description

The plugin is vulnerable to Path Traversal via the `fsReference` AJAX route due to the `findSourceFile()` method normalizing user-supplied `ref` paths containing `../` directory traversal sequences without validating that the resolved path remains within the intended directory. This makes it possible for authenticated attackers with Translator-level access and above (requires the `loco_admin` capability) to read arbitrary `.php`, `.js`, `.json`, and `.twig` files from the server filesystem outside the translation directory, excluding `wp-config.php`.