CVE-2025-30782
Published: 01 April 2025
Summary
CVE-2025-30782 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 25.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2025-30782 is a PHP Local File Inclusion flaw caused by improper control of filenames in include/require statements, classified under CWE-98. It affects the Subscribe to Download Lite plugin for WordPress in all versions through 1.2.9.
An authenticated attacker with low privileges can exploit the issue remotely, though the attack requires high complexity. Successful exploitation can result in high impact to confidentiality, integrity, and availability by allowing inclusion of arbitrary local files on the server.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/subscribe-to-download-lite/vulnerability/wordpress-subscribe-to-download-lite-plugin-1-2-9-local-file-inclusion-vulnerability?_s_id=cve addresses the vulnerability in the affected plugin. The current EPSS score of 0.0082 has a recorded peak of 0.0173.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9107
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Download Lite subscribe-to-download-lite allows PHP Local File Inclusion.This issue affects Subscribe to Download Lite: from n/a through <= 1.2.9.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.