CVE-2025-30785: Subscribe to Download Lite LFI Vulnerability

CVE-2025-30785 Overview

CVE-2025-30785 is a PHP Local File Inclusion (LFI) vulnerability in the WP Shuffle Subscribe to Download Lite WordPress plugin. The flaw stems from improper control of filename input passed to PHP include or require statements [CWE-98]. Attackers with low-privilege authenticated access can include arbitrary local files on the underlying server. The vulnerability affects all versions of subscribe-to-download-lite up to and including 1.2.9. Successful exploitation can lead to source code disclosure, sensitive configuration exposure, and remote code execution when chained with file upload functionality.

Critical Impact
Authenticated attackers can include arbitrary PHP files on the server, potentially leading to remote code execution and full WordPress site compromise.

Affected Products

WP Shuffle Subscribe to Download Lite plugin (subscribe-to-download-lite)
All versions from n/a through 1.2.9
WordPress installations running the vulnerable plugin

Discovery Timeline

2025-03-27 - CVE-2025-30785 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30785

Vulnerability Analysis

The vulnerability resides in the Subscribe to Download Lite plugin's handling of file path parameters. The plugin passes user-controllable input to a PHP include or require statement without sufficient validation or sanitization. This category of flaw is tracked under [CWE-98] (Improper Control of Filename for Include/Require Statement). While the CVE description references PHP Remote File Inclusion, the Patchstack advisory confirms exploitation is limited to Local File Inclusion in the affected plugin context.

Authenticated attackers with at least subscriber-level privileges can manipulate file path parameters to traverse the WordPress filesystem. Targets include wp-config.php, log files, and any PHP file accessible to the web server process.

Root Cause

The root cause is missing input validation on a parameter consumed by a PHP file inclusion function. The plugin does not enforce an allowlist of valid filenames, sanitize directory traversal sequences such as ../, or restrict inclusion to a defined directory. Any string supplied by the attacker reaches the inclusion sink directly.

Attack Vector

An attacker authenticates to the target WordPress site with low-privilege credentials. The attacker then sends a crafted HTTP request to a plugin endpoint containing a manipulated file path parameter. The PHP interpreter resolves the supplied path and executes any PHP code found in the included file. When combined with file upload primitives elsewhere in WordPress, this yields remote code execution.

No verified proof-of-concept code is publicly available. See the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-30785

Indicators of Compromise

HTTP requests to subscribe-to-download-lite plugin endpoints containing directory traversal sequences such as ../ or encoded variants like %2e%2e%2f.
Web server access logs showing parameter values referencing sensitive files such as wp-config.php, /etc/passwd, or PHP session files.
Unexpected PHP errors in logs referencing include() or require() with attacker-controlled paths.
New or modified PHP files within the WordPress installation following suspicious authenticated requests.

Detection Strategies

Inspect WordPress access logs for requests targeting the vulnerable plugin paths combined with suspicious query string values.
Deploy web application firewall rules that flag directory traversal patterns and null-byte injection attempts against plugin endpoints.
Monitor PHP error logs for failed to open stream warnings tied to plugin request handlers.

Monitoring Recommendations

Forward WordPress, PHP, and web server logs to a centralized analytics platform for correlation against authenticated session activity.
Alert on low-privilege user accounts issuing requests to administrative or plugin-specific endpoints outside expected workflows.
Track file integrity changes in the wp-content/uploads and plugin directories to identify post-exploitation artifacts.

How to Mitigate CVE-2025-30785

Immediate Actions Required

Inventory all WordPress sites and identify installations running subscribe-to-download-lite version 1.2.9 or earlier.
Deactivate and remove the plugin if a patched version is not yet available or if the plugin is not business critical.
Rotate WordPress administrative credentials and any secrets stored in wp-config.php if exploitation is suspected.
Audit user accounts for unauthorized subscriber registrations created to abuse the authenticated attack path.

Patch Information

At the time of publication, the vendor advisory tracked by Patchstack indicates the vulnerability affects versions up to and including 1.2.9. Administrators should monitor the Patchstack Vulnerability Report and the WordPress plugin repository for a fixed release and apply it immediately upon availability.

Workarounds

Restrict access to WordPress registration and authentication endpoints using IP allowlisting where feasible.
Apply web application firewall rules that block directory traversal sequences and null bytes targeting plugin parameters.
Configure PHP open_basedir to limit file inclusion to required directories only.
Disable user self-registration on affected WordPress sites until the plugin is patched or removed.

bash

# Configuration example: restrict PHP file access via open_basedir in php.ini
open_basedir = "/var/www/html/:/tmp/"

# Disable WordPress user registration via wp-config.php
define('DISALLOW_FILE_MODS', true);