Loco Translate < 2.2.2 – Authenticated LFI

Description

WordPress plugin Loco Translate version appears to have an Authenticated LFI Vulnerability under the 'Edit Template' Functionality.

The following vulnerability can be exploited by any user with access to the plugin (access can range from Admin to Subscriber)

WPScanTeam Note: Was not able to reproduce this issue with any user other than admin.

Proof of Concept

The following url should yield the contents of (/etc/passwd) where the path parameter was expecting a GetText file but instead receives the payload, and the contents of said file can be viewed under the source tab or the (file-view) functionality under the action parameter. 
 
/wp-admin/admin.php?path=%2Fetc%2Fpasswd&bundle=twentynineteen&domain=twentynineteen&page=loco-theme&action=file-view