CVE-2025-30831
Published: 27 March 2025
Summary
CVE-2025-30831 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-30831 is a PHP Local File Inclusion vulnerability arising from improper control of filenames in include/require statements. It affects the Themify Event Post WordPress plugin developed by themifyme, with all versions through 1.3.2 impacted. The flaw is tracked under CWE-98 and carries a CVSS 3.1 score of 7.5.
An authenticated attacker with low privileges can supply a crafted filename parameter over the network to force inclusion of arbitrary local files on the server. Successful exploitation can yield disclosure of sensitive information as well as the ability to execute arbitrary code, resulting in high impact to confidentiality, integrity, and availability despite the noted attack complexity.
The public advisory published via PatchStack identifies the issue in the Themify Event Post plugin and points administrators to the need for an update once a fixed release becomes available.
EPSS for the CVE remains low and unchanged at 0.0186 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8347
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Event Post themify-event-post allows PHP Local File Inclusion.This issue affects Themify Event Post: from n/a through <= 1.3.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing WordPress plugin allows local file inclusion leading to arbitrary PHP code execution and system compromise over the network.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the improper filename control in PHP include/require by enforcing validation of user-supplied inputs used for file inclusion in the Themify Event Post plugin.
Requires timely identification, reporting, and patching of the LFI vulnerability in Themify Event Post plugin versions through 1.3.2 to eliminate the exploitable flaw.
Enforces secure configuration settings for PHP and web server environments, such as open_basedir restrictions and disabling dangerous includes, to limit local file access even if input validation fails.