CVE-2025-58785: Ray Enterprise Translation Auth Bypass Flaw

CVE-2025-58785 Overview

CVE-2025-58785 is a missing authorization vulnerability in the Ray Enterprise Translation plugin (lingotek-translation) for WordPress, authored by Jiro Sasamoto. The flaw stems from incorrectly configured access control security levels [CWE-862], allowing authenticated users with low privileges to reach functionality that should be restricted. The issue affects Ray Enterprise Translation versions up to and including 1.7.2.

Critical Impact
An authenticated attacker with low privileges can invoke restricted plugin functions over the network, resulting in limited impact to integrity and availability of translation data managed by the plugin.

Affected Products

Jiro Sasamoto Ray Enterprise Translation (lingotek-translation) WordPress plugin
Versions from n/a through <= 1.7.2
WordPress sites with the plugin installed and activated

Discovery Timeline

2025-09-05 - CVE-2025-58785 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58785

Vulnerability Analysis

The vulnerability is a broken access control weakness in the Ray Enterprise Translation plugin. One or more plugin endpoints fail to verify that the requesting user holds the correct capability or role before performing privileged actions. An attacker with a low-privileged authenticated session on the WordPress instance can invoke these endpoints to affect translation configuration or content managed by the plugin.

The weakness maps to CWE-862: Missing Authorization. Because the attack occurs over the network and requires only low privileges with no user interaction, standard WordPress subscriber-level accounts on sites that permit registration can meet the attacker prerequisites.

Root Cause

The root cause is the absence of capability checks (for example, current_user_can()) or nonce validation on plugin request handlers. When authorization controls are omitted or misconfigured, WordPress does not enforce role separation for those endpoints, leaving them reachable by any authenticated session. See the Patchstack Vulnerability Report for advisory details.

Attack Vector

Exploitation is remote and requires an authenticated account on the target WordPress site. The attacker sends a crafted HTTP request to the vulnerable plugin endpoint, bypassing the intended role gating. Successful exploitation produces limited confidentiality, integrity, and availability impact scoped to plugin-managed resources, consistent with the observed medium severity rating.

No public proof-of-concept exploit is currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list. The EPSS score is 0.259% (17.294 percentile), indicating a low near-term exploitation probability.

Detection Methods for CVE-2025-58785

Indicators of Compromise

Unexpected HTTP POST or GET requests to lingotek-translation plugin endpoints originating from low-privileged user sessions
Modifications to translation configuration, language mappings, or post metadata not attributable to administrator activity
New or altered plugin-managed content authored by subscriber-level or contributor-level accounts

Detection Strategies

Review WordPress access logs for requests to /wp-admin/admin-ajax.php or plugin action endpoints tied to lingotek-translation from non-administrator users
Correlate WordPress user activity logs against role assignments to identify capability escalations against plugin functions
Compare installed plugin versions against the fixed release; flag any host running version 1.7.2 or earlier

Monitoring Recommendations

Enable WordPress audit logging and forward events into a centralized SIEM or data lake for retention and correlation
Alert on plugin configuration changes performed by accounts below the Editor role
Monitor for new user registrations followed shortly by requests to plugin AJAX or REST endpoints

How to Mitigate CVE-2025-58785

Immediate Actions Required

Update the Ray Enterprise Translation (lingotek-translation) plugin to a version later than 1.7.2 once released by the maintainer
Audit WordPress user accounts and remove or downgrade any unnecessary low-privileged accounts, particularly on sites with open registration
Restrict access to /wp-admin/ and admin-ajax.php at the web application firewall or reverse proxy layer where feasible

Patch Information

The advisory in the Patchstack Vulnerability Report identifies versions through 1.7.2 as vulnerable. Administrators should track the WordPress plugin repository for a patched release addressing the missing authorization checks and apply it as soon as it becomes available.

Workarounds

Deactivate the Ray Enterprise Translation plugin until a fixed version is installed if translation functionality is not business-critical
Disable open user registration (Settings > General > Membership) to reduce the pool of authenticated accounts available to attackers
Deploy a virtual patch through a WordPress-aware WAF to block unauthenticated and low-privileged requests to affected plugin endpoints

bash

# Configuration example: disable open registration and enforce least privilege via WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber
wp plugin deactivate lingotek-translation