The Ray Enterprise Translation plugin in WordPress contains a flaw where the filename supplied to an include or require call is not properly validated, allowing a local file inclusion attack that could read or execute arbitrary files on the server. This flaw represents a CWE‑98 vulnerability (Improper Control of Filename for Include/Require Statement). Because the vulnerability can be triggered through CSRF, an attacker could force a logged‑in user to send a crafted request that exploits the missing validation. Local file inclusion can lead to disclosure of sensitive files, the ability to inject PHP code, or full compromise of the web application.

All releases of the Ray Enterprise Translation plugin up to and including version 1.7.0 are affected. The vendor Jiro Sasamoto lists the vulnerability as applying from n/a through <= 1.7.0, indicating that any installed copy of the plugin in that range is vulnerable.

The flaw carries a CVSS score of 7.5 and an EPSS score of 3 %. It is not listed in the CISA KEV catalog. The low exploitation probability and lack of public exploitation evidence suggest the threat remains low to moderate. However, the nature of the vulnerability – requiring a CSRF trigger – means that attacks are easier to execute once a victim is tricked into submitting a malicious request. Operators should treat the issue as high risk.