CVE-2025-30782: Subscribe to Download Lite LFI Vulnerability

CVE-2025-30782 Overview

CVE-2025-30782 is a PHP Local File Inclusion (LFI) vulnerability in the WP Shuffle Subscribe to Download Lite WordPress plugin. The flaw stems from improper control of filename parameters used in PHP include or require statements [CWE-98]. Authenticated attackers with low privileges can include arbitrary local PHP files on the server, potentially leading to sensitive information disclosure, code execution through log poisoning, or session hijacking. The vulnerability affects all versions of Subscribe to Download Lite up to and including 1.2.9. The issue was published to the National Vulnerability Database (NVD) on April 1, 2025.

Critical Impact
Authenticated attackers can include arbitrary local files on the WordPress server, exposing sensitive configuration data and enabling potential remote code execution paths.

Affected Products

WP Shuffle Subscribe to Download Lite plugin for WordPress
All versions from initial release through 1.2.9
WordPress sites using the subscribe-to-download-lite plugin

Discovery Timeline

2025-04-01 - CVE-2025-30782 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30782

Vulnerability Analysis

The vulnerability originates from unsafe handling of user-controllable input passed to PHP file inclusion functions. When the Subscribe to Download Lite plugin constructs a file path for include, require, include_once, or require_once calls, it fails to properly validate or sanitize the filename parameter. This allows an attacker to manipulate the input and reference files outside the intended directory.

The classification under [CWE-98] identifies this as improper control of filename for include/require statements. While the CWE title references PHP Remote File Inclusion, the exploitation path here is Local File Inclusion, meaning the attacker references files already present on the server rather than remote resources. The EPSS value indicates a modest but non-trivial probability of exploitation attempts.

Root Cause

The plugin accepts a filename or path parameter from an authenticated request and passes it into a PHP file inclusion function without sufficient validation. Missing checks include filtering of directory traversal sequences such as ../, absence of an allowlist of permitted files, and lack of restriction to a specific base directory. This design permits path manipulation that resolves outside the plugin's expected scope.

Attack Vector

An attacker with at least a low-privilege authenticated account submits a crafted request to the vulnerable plugin endpoint. The request contains a manipulated filename referencing a target file such as wp-config.php, log files, or uploaded content. The server executes or discloses the referenced file within the PHP process context. Successful exploitation can expose database credentials, authentication keys, and other secrets, and may enable code execution by including attacker-controlled files uploaded through other channels.

See the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-30782

Indicators of Compromise

HTTP requests to Subscribe to Download Lite plugin endpoints containing directory traversal sequences such as ../ or URL-encoded equivalents %2e%2e%2f
Web server access logs showing plugin parameter values referencing sensitive files like wp-config.php, /etc/passwd, or PHP session files
Unexpected PHP process reads of files outside the plugin directory /wp-content/plugins/subscribe-to-download-lite/
Access log entries from authenticated low-privilege accounts targeting plugin AJAX or admin-post endpoints

Detection Strategies

Deploy web application firewall (WAF) rules that inspect plugin request parameters for path traversal patterns and null byte injection attempts
Enable WordPress activity logging to correlate authenticated user actions with plugin parameter values
Monitor file system audit logs for PHP process reads of wp-config.php and other sensitive files initiated outside expected code paths

Monitoring Recommendations

Alert on any HTTP request to subscribe-to-download-lite endpoints containing ../, encoded traversal sequences, or absolute filesystem paths
Track outbound anomalies from the web server that could indicate exfiltration of included file contents
Review PHP error logs for include/require warnings referencing unexpected paths, which often accompany LFI probing

How to Mitigate CVE-2025-30782

Immediate Actions Required

Deactivate the Subscribe to Download Lite plugin on all WordPress installations running version 1.2.9 or earlier until a fixed version is confirmed available
Rotate WordPress secrets in wp-config.php including AUTH_KEY, SECURE_AUTH_KEY, and database credentials if exploitation is suspected
Audit user accounts with subscriber-level access or higher and remove accounts that are unrecognized or inactive
Restrict administrative and plugin endpoints to trusted IP ranges where feasible

Patch Information

At the time of NVD publication, the advisory listed affected versions from n/a through 1.2.9 with no fixed version specified. Consult the Patchstack Vulnerability Report for updates on a vendor-issued patch. If no patch is available, replace the plugin with an alternative solution.

Workarounds

Remove or replace the subscribe-to-download-lite plugin directory if the plugin is not essential to site operations
Configure the web server to deny direct access to plugin PHP files that are not intended for external invocation
Apply a WAF ruleset that blocks path traversal sequences and known LFI payloads on requests targeting the plugin
Set PHP open_basedir to restrict file system access to the WordPress installation directory, limiting the scope of any successful LFI

bash

# PHP open_basedir hardening example in php.ini or per-vhost configuration
open_basedir = "/var/www/html/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
allow_url_include = Off
allow_url_fopen = Off