CVE-2025-31030: Ray Enterprise Translation LFI Vulnerability

CVE-2025-31030 Overview

CVE-2025-31030 is a PHP Local File Inclusion (LFI) vulnerability in the Jiro Sasamoto Ray Enterprise Translation plugin (lingotek-translation) for WordPress. The flaw affects all versions up to and including 1.7.0 and is tracked under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program. An attacker can manipulate a filename parameter passed to a PHP include or require statement to load arbitrary local files. Successful exploitation can lead to disclosure of sensitive files, execution of attacker-controlled PHP, and full compromise of the hosting WordPress instance.

Critical Impact

Attackers who convince an authorized user to trigger a crafted request can include arbitrary local PHP files, leading to remote code execution on the WordPress server.

Affected Products

• Jiro Sasamoto Ray Enterprise Translation (lingotek-translation) WordPress plugin
• All versions from initial release through 1.7.0
• WordPress sites running the affected plugin versions

Discovery Timeline

• 2025-04-17 - CVE-2025-31030 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-31030

Vulnerability Analysis

The vulnerability stems from improper validation of user-supplied input used in PHP file inclusion statements. The plugin passes a filename or path value into a PHP include, include_once, require, or require_once call without sufficient sanitization or allow-listing. An attacker who controls the input can reference files outside the intended directory using traversal sequences such as ../ or absolute paths. PHP then loads and executes the contents of the targeted file in the context of the web application.

While the original CWE classification references PHP Remote File Inclusion, the issue is exploitable as Local File Inclusion in the affected plugin. Attackers can read configuration files such as wp-config.php, harvest database credentials, and read secrets accessible to the web server user. If an attacker can place PHP content into a readable location, including log files, uploads, or session files, the inclusion primitive becomes arbitrary PHP code execution.

The CVSS vector indicates the attack requires user interaction, meaning an authenticated administrator or another privileged user must interact with attacker-controlled input. The EPSS probability is approximately 0.499% as of 2026-05-11.

Root Cause

The plugin builds a path used in a PHP file inclusion directive from untrusted input without enforcing a strict allow-list of permitted files. Missing input normalization permits directory traversal and absolute path references to escape the intended include directory.

Attack Vector

Exploitation occurs over the network against the WordPress HTTP interface. The attacker crafts a request containing a path parameter that traverses to an attacker-chosen file. The request must be delivered through a flow that requires user interaction, such as a privileged user clicking a malicious link. See the Patchstack Vulnerability Report for additional technical context.

// No verified public proof-of-concept code is available.
// The vulnerability pattern resembles:
//   include( $base_path . $_REQUEST['file'] . '.php' );
// Without sanitization, supplying traversal payloads loads arbitrary files.

Detection Methods for CVE-2025-31030

Indicators of Compromise

• HTTP requests to lingotek-translation plugin endpoints containing ../, ..\, encoded traversal sequences (%2e%2e%2f), or absolute filesystem paths in query or POST parameters.
• Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or PHP session files originating from the web server process.
• New or modified PHP files in the WordPress wp-content/uploads/ directory shortly after suspicious plugin requests.

Detection Strategies

• Inspect web server and WordPress access logs for parameters containing traversal patterns directed at the lingotek-translation plugin path.
• Deploy WAF rules that block path traversal sequences and null byte payloads in plugin parameters.
• Compare installed plugin file hashes against the known-good 1.7.0 release to identify post-exploitation tampering.

Monitoring Recommendations

• Alert on wp-config.php reads by the PHP-FPM or web server process outside expected application paths.
• Monitor outbound HTTP connections from the WordPress host to detect credential exfiltration following file disclosure.
• Track plugin enumeration scans and repeated 200/500 responses on lingotek-translation endpoints.

How to Mitigate CVE-2025-31030

Immediate Actions Required

• Disable or uninstall the Ray Enterprise Translation (lingotek-translation) plugin on any site running version 1.7.0 or earlier until a fixed release is confirmed.
• Rotate WordPress database credentials, AUTH_KEY and salt values in wp-config.php, and any API tokens accessible to the web server user.
• Audit wp-content/uploads/ and plugin directories for unexpected PHP files or webshells.

Patch Information

At the time of publication, the vendor advisory referenced in the Patchstack Vulnerability Report lists versions through 1.7.0 as affected. Administrators should consult the plugin maintainer page for any release beyond 1.7.0 and apply updates as soon as a patched version is published.

Workarounds

• Restrict access to WordPress administrative endpoints using IP allow-listing or VPN-only access until a patch is applied.
• Configure a WAF rule that blocks ../, encoded traversal variants, and absolute paths in requests targeting wp-content/plugins/lingotek-translation/.
• Set PHP open_basedir to confine the WordPress process to its document root and prevent inclusion of files outside the application directory.

# Example PHP open_basedir restriction for the WordPress vhost
php_admin_value[open_basedir] = "/var/www/wordpress/:/tmp/"

# Example ModSecurity rule snippet to block traversal on the plugin path
SecRule REQUEST_URI "@contains /wp-content/plugins/lingotek-translation/" \
  "chain,deny,status:403,id:1003103,msg:'CVE-2025-31030 LFI attempt'"
  SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|/etc/|wp-config)" "t:lowercase,t:urlDecodeUni"