CVE-2025-30820
Published: 27 March 2025
Summary
CVE-2025-30820 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-30820 is a PHP Local File Inclusion vulnerability (CWE-98) in the WishSuite WordPress plugin by HT Plugins. The flaw stems from improper control of filenames in include/require statements and affects all versions through 1.4.4. It carries a CVSS 3.1 score of 7.5, reflecting network attack vector, high attack complexity, low privileges required, and high impact across confidentiality, integrity, and availability.
An authenticated attacker with low-privileged WordPress access can supply a crafted filename parameter over the network to force inclusion of arbitrary local files on the server. Successful exploitation can result in disclosure of sensitive configuration or source files, arbitrary code execution, or full site compromise.
The primary advisory reference is published by Patchstack and identifies the affected plugin versions. The associated EPSS score has remained flat at 0.0165 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8358
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins WishSuite wishsuite allows PHP Local File Inclusion.This issue affects WishSuite: from n/a through <= 1.4.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a Local File Inclusion vulnerability in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications via network access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the specific PHP Local File Inclusion flaw in WishSuite plugin versions through <=1.4.4 to prevent exploitation.
Enforces validation of user-supplied filenames at entry points for PHP include/require statements, comprehensively addressing improper filename control leading to LFI.
Restricts information inputs such as filenames and file paths to organization-defined safe criteria, preventing malicious LFI paths in the vulnerable plugin.