Improper control of filenames used in PHP include/require statements allows an attacker to specify arbitrary files to be read or executed within the WordPress installation. The vulnerability is classified as a PHP Local File Inclusion that can potentially expose sensitive configuration files or lead to arbitrary code execution if malicious content is supplied. The flaw falls under CWE-98, and if exploited it threatens the confidentiality of site data and the integrity of the application logic.

The Ray Enterprise Translation plugin for WordPress, developed by Jiro Sasamoto, is vulnerable in all releases from the initial version through 1.7.1. Any WordPress site that has this plugin installed and has not upgraded to a version beyond 1.7.1 is directly affected.

With a CVSS score of 7.5 the vulnerability is considered high risk, yet the EPSS suggests a very low likelihood of exploitation—under 1 percent. It is not listed in the CISA KEV catalog, indicating no widespread exploitation to date. Attackers would need the ability to influence the include path parameter, typically through an authenticated site or by manipulating request inputs that feed into the plugin’s include logic. The potential impact ranges from information disclosure to full control of the affected WordPress instance if arbitrary PHP code can be included. Given the low EPSS but high severity, the threat remains significant for sites that rely on this plugin.