CVE-2025-30849
Published: 01 April 2025
Summary
CVE-2025-30849 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in G5Plus Essential Real Estate. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 18.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a PHP Local File Inclusion flaw (CWE-98) stemming from improper control of filenames in include/require statements within the Essential Real Estate WordPress plugin by g5theme. It affects all versions through 5.2.0 and carries a CVSS 3.1 score of 8.1.
An unauthenticated remote attacker can supply a crafted filename parameter over the network to force inclusion of arbitrary local files on the server. Successful exploitation can yield disclosure of sensitive configuration or source files and, depending on the environment, full compromise of confidentiality, integrity, and availability.
The Patchstack advisory confirms the issue in the Essential Real Estate plugin at version 5.2.0 and provides the canonical reference for the vulnerability. The associated EPSS score has remained flat at 0.0145 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9097
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate essential-real-estate allows PHP Local File Inclusion.This issue affects Essential Real Estate: from n/a through <= 5.2.0.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.