What is the CVSS score of CVE-2025-60076?

CVE-2025-60076 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Ray Enterprise Translation are affected by CVE-2025-60076?

CVE-2025-60076 affects Ray Enterprise Translation WordPress plugin versions through 1.7.1, enabling unauthenticated remote attackers to read arbitrary files from affected servers through path…

How to fix or mitigate CVE-2025-60076?

Within 24 hours: Identify all WordPress instances using Ray Enterprise Translation plugin and verify version numbers via admin dashboard or wp-content/plugins directory. Within 7 days: Disable or remove the plugin immediately if version 1.7.1 or earlier is detected; contact Ray Enterprise for patch availability timeline and request alternative translation solutions. Within 30 days: Audit server logs for unauthorized file access attempts targeting .php, .env, wp-config.php, and database backup files; scan affected servers for evidence of exfiltrated data using file integrity monitoring logs.

Ray Enterprise Translation CVE-2025-60076

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-18 audit@patchstack.com

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:16 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 18, 2025 - 08:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows PHP Local File Inclusion.This issue affects Ray Enterprise Translation: from n/a through <= 1.7.1.

AnalysisAI

Local file inclusion in Ray Enterprise Translation WordPress plugin through version 1.7.1 allows remote attackers to read arbitrary files on the server via path traversal in PHP include statements. Despite the moderate CVSS score of 7.5, the EPSS probability of 0.06% (20th percentile) indicates minimal observed exploitation activity in the wild. Patchstack has cataloged this vulnerability with proof-of-concept details, requiring attackers to overcome high complexity conditions and user interaction to achieve impact across confidentiality, integrity, and availability.

Technical ContextAI

This vulnerability stems from improper validation of user-controlled input passed to PHP include/require functions, classified as CWE-98 (PHP Remote File Inclusion). Despite the CWE classification suggesting remote file inclusion, the actual exploit vector is local file inclusion based on the Patchstack reference and vulnerability tags. The Ray Enterprise Translation plugin (lingotek-translation) for WordPress fails to sanitize file path parameters before passing them to PHP file inclusion functions, allowing attackers to use directory traversal sequences (../) to access files outside the intended directory. While the CPE data is not provided, this affects the WordPress plugin ecosystem where such vulnerabilities commonly arise from insufficient input validation in localization and translation management components.

Affected ProductsAI

Ray Enterprise Translation (also known as lingotek-translation) WordPress plugin versions from the initial release through version 1.7.1 are confirmed vulnerable. The plugin is authored by Jiro Sasamoto and provides enterprise translation workflow management for WordPress sites. According to the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Plugin/lingotek-translation/vulnerability/wordpress-ray-enterprise-translation-plugin-1-7-1-local-file-inclusion-vulnerability, all versions up to and including 1.7.1 contain the local file inclusion flaw. No CPE identifiers were provided in the source data, limiting automated vulnerability scanning coverage.

RemediationAI

Upgrade Ray Enterprise Translation plugin to a patched version newer than 1.7.1 if available, checking the WordPress plugin repository or vendor communications for the fixed release. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/lingotek-translation/vulnerability/wordpress-ray-enterprise-translation-plugin-1-7-1-local-file-inclusion-vulnerability for the latest remediation guidance. If no patched version exists, implement compensating controls: disable the Ray Enterprise Translation plugin entirely if not business-critical, restrict WordPress admin access to trusted IP ranges via web application firewall rules (may impact legitimate remote administrators), deploy virtual patching through WAF rules targeting directory traversal patterns in HTTP parameters (requires testing to avoid blocking legitimate translation workflows), and enable comprehensive file access logging to detect exploitation attempts. Each workaround trades functionality or administrative convenience for security - coordinate with content management teams before implementing.