CVE-2025-30596: include-file Path Traversal Vulnerability

CVE-2025-30596 Overview

CVE-2025-30596 is a path traversal vulnerability in the include-file WordPress plugin by tstafford. The flaw allows authenticated attackers to read arbitrary files from the underlying server by manipulating file path parameters. It affects all versions of include-file up to and including version 1. The vulnerability is classified under CWE-22, Improper Limitation of a Pathname to a Restricted Directory. Patchstack tracks this issue as an arbitrary file download vulnerability. Successful exploitation exposes sensitive server-side files, including WordPress configuration data and credentials stored on disk.

Critical Impact
Authenticated attackers can download arbitrary files from the WordPress host, including wp-config.php, exposing database credentials and authentication secrets.

Affected Products

tstafford include-file WordPress plugin, all versions through 1

Discovery Timeline

2025-04-03 - CVE-2025-30596 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30596

Vulnerability Analysis

The include-file plugin exposes functionality that accepts a filename or path parameter and returns the contents of the requested file. The plugin fails to constrain the resolved path to an allowed directory, letting attackers reference locations outside the plugin's intended scope. An attacker with low-privileged authenticated access can request server files by supplying traversal sequences such as ../../ in the vulnerable parameter. The response returns the raw file contents, enabling arbitrary file disclosure across the WordPress installation and host filesystem.

Root Cause

The root cause is missing canonicalization and allowlist validation on user-supplied file paths. The plugin trusts the input and passes it directly to a file-read routine without stripping traversal sequences or verifying that the resolved path stays within a designated directory. This class of flaw maps to CWE-22.

Attack Vector

Exploitation occurs over the network against the vulnerable WordPress endpoint. The attacker must hold valid credentials at a low privilege tier to reach the vulnerable functionality. Once authenticated, the attacker submits a crafted request containing a relative path that escapes the plugin's working directory. High-value targets include wp-config.php, .htaccess, and files under /etc readable by the web server user. See the Patchstack advisory for additional technical detail.

Detection Methods for CVE-2025-30596

Indicators of Compromise

HTTP requests to include-file plugin endpoints containing traversal sequences such as ../, ..%2f, or absolute paths like /etc/passwd.
Web server access logs showing successful 200 OK responses to plugin requests with unusually large response sizes for file reads.
Outbound access to wp-config.php or system files by authenticated low-privilege accounts.

Detection Strategies

Inspect WordPress and web server logs for requests to plugin endpoints containing URL-encoded or raw path traversal patterns.
Deploy web application firewall (WAF) rules that block path traversal signatures against wp-content/plugins/include-file/ URIs.
Correlate authenticated user activity with requests referencing sensitive filenames outside typical plugin behavior.

Monitoring Recommendations

Alert on any read access to wp-config.php or system credential files by the web server process.
Baseline normal request patterns to the plugin and flag deviations in parameter values and response sizes.
Monitor for privilege escalation or lateral movement following suspected file disclosure, since leaked database credentials enable follow-on attacks.

How to Mitigate CVE-2025-30596

Immediate Actions Required

Deactivate and remove the include-file plugin until a patched release is confirmed by the vendor.
Rotate all secrets stored in wp-config.php, including database credentials and WordPress authentication keys and salts.
Audit WordPress user accounts and remove unused low-privilege accounts that could reach the vulnerable endpoint.

Patch Information

No fixed version is listed in the CVE record. The advisory published by Patchstack indicates the vulnerability affects include-file through version 1, with no patched release identified. Administrators should treat the plugin as unmaintained and migrate to an actively supported alternative.

Workarounds

Remove the plugin from wp-content/plugins/ and delete residual files.
Restrict access to WordPress administrative and authenticated endpoints by IP allowlist where feasible.
Enforce least-privilege file permissions on the WordPress host so the web server user cannot read sensitive system files.

bash

# Disable and remove the vulnerable plugin via WP-CLI
wp plugin deactivate include-file
wp plugin delete include-file

# Rotate WordPress salts after suspected disclosure
wp config shuffle-salts