CVE-2025-31030: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability (CVE-2025-31030) was discovered in jbhovik Ray Enterprise Translation plugin versions through 1.7.0. The vulnerability was reported by researcher astra.r3verii on March 28, 2025, and was publicly disclosed on April 10, 2025. This security flaw is classified as an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue is categorized under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). This vulnerability requires no authentication to exploit, making it particularly dangerous (NVD, Patchstack).

The vulnerability could allow malicious actors to include local files of the target website and display their contents. This could potentially lead to exposure of sensitive information, including database credentials, which might result in complete database compromise depending on the system configuration (Patchstack).

The vulnerability is considered highly dangerous and is expected to become mass exploited. It requires no authentication to exploit, making it particularly accessible to potential attackers. The attack vector is network-accessible (AV:N), though it requires high attack complexity (AC:H) and user interaction (UI:R) (Patchstack).

Users are strongly advised to update to version 1.7.1 or later of the Ray Enterprise Translation plugin to resolve this vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).