CVE-2025-31030: Ray Enterprise Translation LFI Vulnerability

CVE-2025-31030 Overview

CVE-2025-31030 is a Local File Inclusion (LFI) vulnerability in the Jiro Sasamoto Ray Enterprise Translation (lingotek-translation) WordPress plugin. The flaw stems from improper control of a filename used in a PHP include/require statement, classified under [CWE-98]. All versions through 1.7.0 are affected. Successful exploitation lets an attacker cause the plugin to include arbitrary local PHP files, potentially leading to information disclosure, sensitive configuration exposure, or code execution if attacker-controlled content can reach an includable path. Exploitation requires user interaction and has high attack complexity, but the impact spans confidentiality, integrity, and availability.

Critical Impact
Attackers can trigger inclusion of arbitrary local PHP files on the WordPress server, exposing sensitive data and enabling potential code execution paths within the application context.

Affected Products

Jiro Sasamoto Ray Enterprise Translation (lingotek-translation) WordPress plugin
All versions from initial release through 1.7.0
WordPress sites with the plugin installed and activated

Discovery Timeline

2025-04-17 - CVE-2025-31030 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-31030

Vulnerability Analysis

The vulnerability is a PHP File Inclusion weakness [CWE-98] in the lingotek-translation plugin. The plugin constructs a path passed to a PHP include or require statement using input that is not adequately validated or constrained to a safe allowlist. As a result, an attacker who can influence that parameter can direct PHP to load files outside the intended directory. Although the upstream CWE class covers Remote File Inclusion, the Patchstack advisory confirms the practical impact here is Local File Inclusion: the include target resolves to files already present on the server.

Root Cause

The root cause is missing or insufficient input sanitization on a filename parameter that flows into a dynamic include/require call. Without canonicalization, path normalization, or strict allowlisting, traversal sequences and absolute paths can redirect the include operation to arbitrary files readable by the PHP process.

Attack Vector

The attack is network-based and requires user interaction, such as an authenticated or privileged user visiting an attacker-crafted link that triggers the vulnerable code path. Attack complexity is high, which suggests specific conditions must be met for reliable exploitation. Once triggered, the attacker can read PHP source, configuration data (including wp-config.php), and, depending on writable upload paths or log poisoning techniques, escalate to arbitrary code execution within the web server context. Refer to the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2025-31030

Indicators of Compromise

HTTP requests to lingotek-translation plugin endpoints containing path traversal sequences such as ../, ..%2f, or null-byte variants in query parameters.
Unexpected PHP errors in web server logs referencing include(), require(), or failed to open stream from plugin files.
Access patterns targeting sensitive paths like wp-config.php, /etc/passwd, or PHP session files via plugin parameters.
Outbound connections or new admin users created shortly after suspicious plugin requests.

Detection Strategies

Inspect web server and WordPress access logs for requests to wp-content/plugins/lingotek-translation/ containing suspicious filename parameters.
Enable PHP error logging and alert on include/require warnings referencing plugin paths.
Deploy a Web Application Firewall (WAF) rule set that flags traversal patterns and absolute file paths in query strings.
Run file integrity monitoring on wp-content/plugins/lingotek-translation/ to detect tampering or webshell drop.

Monitoring Recommendations

Correlate plugin request anomalies with new file creation in upload directories and unexpected PHP process activity.
Track repeated 4xx/5xx responses from the plugin URL space as an early indicator of probing.
Monitor authenticated administrator session activity for unusual click-through patterns matching UI-redress or social-engineering exploitation.
Forward WordPress and PHP logs to a centralized SIEM for retention and behavioral baselining.

How to Mitigate CVE-2025-31030

Immediate Actions Required

Identify any WordPress installations running the lingotek-translation (Ray Enterprise Translation) plugin at version 1.7.0 or earlier.
Deactivate and remove the plugin until a patched release is confirmed installed.
Rotate any secrets stored in wp-config.php, including database credentials and authentication keys, if exploitation cannot be ruled out.
Review administrative user accounts and recently uploaded files for signs of post-exploitation activity.

Patch Information

At the time of publication, the advisory lists all versions <= 1.7.0 as affected and does not identify a fixed version. Consult the Patchstack Vulnerability Report and the plugin's WordPress.org page for the latest patched release. Apply the vendor update as soon as it becomes available.

Workarounds

Remove or disable the lingotek-translation plugin until a vendor patch is published.
Restrict access to /wp-admin/ and plugin endpoints by source IP using web server or WAF rules.
Set open_basedir in PHP to constrain file inclusion to the WordPress document root and its required dependencies.
Set allow_url_include = Off and allow_url_fopen = Off in php.ini to reduce inclusion attack surface.

bash

# Example php.ini hardening for inclusion controls
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate lingotek-translation
wp plugin delete lingotek-translation