CVE-2025-30846
Published: 27 March 2025
Summary
CVE-2025-30846 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 14.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-30846 by identifying, prioritizing, and applying patches or updates to vulnerable versions of the mp-restaurant-menu WordPress plugin.
Requires validation of untrusted filename inputs to PHP include/require statements, preventing local file inclusion exploitation in the plugin.
Enforces secure configuration settings for PHP environments, such as open_basedir restrictions, to limit the scope of local file access during LFI attempts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in public-facing WordPress plugin enables exploitation of the app (T1190), direct local file access (T1005), and arbitrary code execution via PHP include (T1059).
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows PHP Local File Inclusion.This issue affects Restaurant Menu by MotoPress: from n/a through <= 2.4.4.
Deeper analysisAI
CVE-2025-30846 is a PHP Local File Inclusion vulnerability, stemming from improper control of filename for include/require statements (CWE-98), in the Restaurant Menu by MotoPress WordPress plugin (mp-restaurant-menu). The flaw affects all versions from n/a through 2.4.4 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited by a low-privileged authenticated user over the network with low attack complexity and no user interaction required. Successful exploitation enables high-impact outcomes, including unauthorized access to sensitive local files, potential arbitrary code execution via PHP inclusion, and disruption of confidentiality, integrity, and availability.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mp-restaurant-menu/vulnerability/wordpress-restaurant-menu-by-motopress-plugin-2-4-4-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)