CVE-2025-30890
Published: 27 March 2025
Summary
CVE-2025-30890 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
The vulnerability is a PHP Local File Inclusion issue, classified under CWE-98 as improper control of filenames in include/require statements, affecting the SuitePlugins Login Widget for Ultimate Member WordPress plugin in versions up to and including 1.1.2. It carries a CVSS 3.1 score of 7.5.
An authenticated attacker with low privileges can exploit the flaw over the network, though the attack requires high complexity. Successful exploitation can result in high impacts to confidentiality, integrity, and availability by allowing inclusion of arbitrary local files.
The issue is tracked in the Patchstack vulnerability database, which identifies the affected plugin versions and links to the corresponding advisory entry for further details on available updates.
EPSS for the CVE rose from a low baseline to a recorded peak of 0.0221, indicating emerging exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8320
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SuitePlugins Login Widget for Ultimate Member login-widget-for-ultimate-member allows PHP Local File Inclusion.This issue affects Login Widget for Ultimate Member: from n/a through <= 1.1.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a network-exploitable PHP file inclusion vulnerability (LFI/RFI) in a public-facing WordPress plugin, directly enabling T1190 Exploit Public-Facing Application with high impact on confidentiality, integrity, and availability.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the specific PHP Local File Inclusion flaw in the Login Widget plugin, preventing exploitation through patching.
Mandates information input validation at entry points, directly addressing the improper filename control in PHP include/require statements that enables LFI.
Vulnerability scanning detects the presence of the affected plugin versions across all versions up to 1.1.2, enabling remediation before network exploitation.