WordPress Plugin Vulnerabilities

Ray Enterprise Translation <= 1.7.1 - Missing Authorization

Description

The Ray Enterprise Translation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.7.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
lingotek-translation
No known fix

References

CVE
CVE-2025-58785
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/f7e2246d-704c-40df-ab82-ffdb85e78cd3

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
LVT-tholv2k
Verified
No
WPVDB ID
7376f9ab-6ca0-48c8-babe-58bde1990936

Timeline

Publicly Published
2025-09-05 (about 1 year ago)
Added
2025-09-09 (about 1 year ago)
Last Updated
2025-09-09 (about 1 year ago)

Other

Published
Title
Published
2025-09-19
Title
SureForms – Drag and Drop Form Builder for WordPress < 1.12.1 - Missing Authorization to Authenticated (Contributor+) Form Creation
Published
2025-04-07
Title
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update
Published
2025-06-12
Title
Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal < 16.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read
Published
2024-08-12
Title
Analytify < 5.4.0 - Cross-Site Request Forgery to Opt-out
Published
2026-08-06
Title
Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering