CVE-2025-30594: Include URL Path Traversal Vulnerability

CVE-2025-30594 Overview

CVE-2025-30594 is a path traversal vulnerability in the samsk Include URL WordPress plugin (include-url) affecting all versions up to and including 0.3.5. The flaw is categorized as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. An authenticated attacker with low-level privileges can abuse the plugin to download arbitrary files from the underlying web server. Successful exploitation leads to disclosure of sensitive configuration data, credentials, and application source code.

Critical Impact
Authenticated attackers can read arbitrary files on the WordPress host, including wp-config.php and other files containing database credentials and secrets.

Affected Products

samsk Include URL WordPress plugin, all versions through 0.3.5
WordPress sites where the include-url plugin is installed and activated
Any deployment allowing untrusted authenticated users to interact with the plugin

Discovery Timeline

2025-04-01 - CVE-2025-30594 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30594

Vulnerability Analysis

The Include URL plugin allows WordPress content to embed remote or local resources by URL. The plugin fails to validate or normalize user-supplied path components before resolving them on the server file system. An attacker can supply a crafted path containing ../ traversal sequences or a file:// scheme reference to escape the intended directory and read arbitrary files.

Because the vulnerability sits behind low-privilege authentication, any account able to interact with the plugin's fetch functionality can retrieve server-side files. Attackers typically target wp-config.php to extract database credentials, authentication salts, and secret keys, enabling follow-on database access and session forgery.

Root Cause

The root cause is missing input sanitization on the path or URL parameter processed by the plugin's file inclusion routine. The code passes attacker-controlled input into a file read or fetch operation without canonicalizing the path or restricting it to an allowlisted directory. This is a classic CWE-22 pattern in which the trust boundary between user input and file system operations is not enforced.

Attack Vector

The attack is delivered over the network against the WordPress HTTP endpoint exposed by the plugin. The attacker authenticates with a low-privilege account, then submits a request that includes a traversal payload targeting a sensitive server file. The plugin resolves the path and returns the file contents in the response body. No user interaction is required beyond the attacker's own authenticated session.

For payload structure and reproduction details, see the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2025-30594

Indicators of Compromise

HTTP requests to Include URL plugin endpoints containing ../, ..%2f, or encoded traversal sequences in URL or path parameters.
Requests referencing sensitive files such as wp-config.php, /etc/passwd, or .htaccess in plugin parameters.
Unexpected outbound reads of local files by the PHP-FPM or web server process originating from the include-url plugin directory.

Detection Strategies

Inspect web server and WordPress access logs for authenticated requests to the plugin containing traversal patterns or file:// schemes.
Deploy a Web Application Firewall (WAF) rule that flags path traversal payloads targeting /wp-content/plugins/include-url/.
Correlate low-privilege user sessions with anomalous read access to WordPress configuration files.

Monitoring Recommendations

Alert on any response body from the plugin endpoint that contains strings such as DB_PASSWORD, AUTH_KEY, or SECURE_AUTH_SALT.
Monitor for new or unexpected low-privilege account creation on WordPress sites running the plugin.
Enable file integrity monitoring on wp-config.php and plugin directories to detect subsequent tampering after credential theft.

How to Mitigate CVE-2025-30594

Immediate Actions Required

Deactivate and remove the Include URL plugin until a fixed version is available, since no patched release is listed for versions above 0.3.5.
Audit WordPress user accounts and revoke unnecessary low-privilege access to reduce the pool of potential attackers.
Rotate all secrets stored in wp-config.php, including database credentials and authentication keys, if exploitation is suspected.

Patch Information

The advisory identifies all versions of the samsk Include URL plugin through 0.3.5 as affected and does not list a fixed version at the time of publication. Consult the Patchstack WordPress Vulnerability Report for the current remediation status and any vendor-supplied update.

Workarounds

Uninstall the include-url plugin and replace it with a maintained alternative that validates remote and local resource paths.
Enforce virtual patching at the WAF layer by blocking traversal sequences and file:// URIs on plugin endpoints.
Restrict file system permissions so the web server process cannot read files outside the WordPress webroot.

bash

# Example WAF rule concept: block traversal payloads to the include-url plugin
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@contains /wp-content/plugins/include-url/" \
  "chain,deny,status:403,id:1009301,msg:'CVE-2025-30594 path traversal attempt'"
  SecRule ARGS "@rx (\.\./|\.\.%2f|file://)" "t:lowercase,t:urlDecodeUni"