Cyber Posture

CVE-2025-30829

High

Published: 27 March 2025

Published
27 March 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0042 62.2th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

Security Summary

CVE-2025-30829 is an Improper Control of Filename for Include/Require Statement vulnerability, known as PHP Remote File Inclusion, in the Arraytics WPCafe (wp-cafe) WordPress plugin. It enables PHP Local File Inclusion and affects all versions from n/a through 2.2.31.

The vulnerability carries a CVSS v3.1 base score of 7.5 (High), with metrics AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Low-privileged authenticated users can exploit it over the network with high attack complexity and no user interaction, achieving high impacts on confidentiality, integrity, and availability through local file inclusion.

Patchstack provides details on the vulnerability, including mitigation guidance, in its advisory at https://patchstack.com/database/Wordpress/Plugin/wp-cafe/vulnerability/wordpress-wpcafe-plugin-2-2-31-local-file-inclusion-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
Why these techniques?

The vulnerability is a local file inclusion flaw in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications (T1190), data collection from local system files (T1005), and code execution via included PHP scripts (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References