CVE-2025-30814: The Post Grid LFI Vulnerability

CVE-2025-30814 Overview

CVE-2025-30814 is a PHP Local File Inclusion (LFI) vulnerability in the RadiusTheme The Post Grid WordPress plugin. The flaw stems from improper control of filenames passed to PHP include or require statements [CWE-98]. Attackers with low-privilege authenticated access can coerce the plugin into loading attacker-controlled file paths. The vulnerability affects all versions of the-post-grid up to and including 7.7.17. Successful exploitation can lead to disclosure of sensitive server-side files, execution of locally writable PHP files, and full compromise of the underlying WordPress instance.

Critical Impact
Authenticated attackers can include arbitrary local PHP files on the server, leading to information disclosure and potential remote code execution on affected WordPress sites.

Affected Products

RadiusTheme The Post Grid (the-post-grid) WordPress plugin
All versions from initial release through 7.7.17
WordPress sites running the vulnerable plugin versions

Discovery Timeline

2025-03-27 - CVE-2025-30814 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30814

Vulnerability Analysis

The vulnerability is classified under [CWE-98]: Improper Control of Filename for Include/Require Statement in PHP Program. The plugin accepts user-supplied input that is concatenated into a PHP include or require path without sufficient validation or path normalization. Because PHP resolves these statements relative to the server filesystem, an attacker can traverse directories and force the inclusion of files outside the plugin's intended template directory.

The Patchstack advisory categorizes this issue as Local File Inclusion rather than Remote File Inclusion, indicating the affected sink loads files from the local filesystem. An attacker can read configuration files such as wp-config.php if exposed through a wrapper, or trigger execution of uploaded PHP content stored elsewhere on the server.

Root Cause

The root cause is the absence of an allowlist for template or partial filenames before the value reaches a PHP include/require statement. The plugin trusts user-controlled parameters when assembling the path argument. Path traversal sequences such as ../ and absolute path injection are not stripped or rejected.

Attack Vector

Exploitation is performed over the network against a WordPress site with the vulnerable plugin enabled. The attacker requires low-privilege authenticated credentials, and attack complexity is elevated because specific request conditions must be met. Once a tainted path reaches the include sink, PHP loads and executes the referenced file in the context of the web server user.

No public proof-of-concept code has been verified for this CVE. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-30814

Indicators of Compromise

Unexpected HTTP requests to the-post-grid plugin endpoints containing ../ sequences, null bytes, or absolute filesystem paths
Web server access logs showing parameter values referencing wp-config.php, /etc/passwd, /proc/self/environ, or PHP wrapper schemes such as php://filter
New or modified PHP files in wp-content/uploads/ followed by plugin requests referencing those filenames
Authenticated sessions from low-privilege accounts issuing template or AJAX requests outside normal user behavior

Detection Strategies

Inspect PHP error logs for include() or require() warnings referencing paths under wp-content/plugins/the-post-grid/
Apply web application firewall rules that flag traversal patterns and PHP stream wrappers in query strings and POST bodies targeting plugin routes
Correlate authentication events with abnormal plugin parameter values to identify abuse of low-privilege accounts

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/, plugin directories, and wp-config.php
Forward WordPress, PHP-FPM, and reverse proxy logs to a centralized SIEM for correlation and retention
Alert on PHP execution originating from upload directories, which is a common post-exploitation pattern for LFI-to-RCE chains

How to Mitigate CVE-2025-30814

Immediate Actions Required

Update the the-post-grid plugin to a version newer than 7.7.17 as soon as a fixed release is available from RadiusTheme
Audit WordPress user accounts and revoke unnecessary low-privilege access that could be leveraged for authenticated exploitation
Review web server and PHP logs for prior exploitation attempts referencing plugin endpoints with traversal payloads

Patch Information

RadiusTheme has been notified through the Patchstack coordinated disclosure program. Administrators should monitor the Patchstack Vulnerability Report and the official plugin changelog for the fixed version. Until a vendor patch is installed, the plugin should be considered actively exploitable.

Workarounds

Disable or remove the the-post-grid plugin until a patched version is deployed
Deploy WAF rules that block path traversal sequences and PHP stream wrappers against plugin URIs
Set open_basedir in PHP configuration to restrict file access to the WordPress document root and required system directories
Disable PHP execution within wp-content/uploads/ using web server configuration to limit LFI-to-RCE escalation

bash

# Example: restrict PHP file access via php.ini open_basedir
open_basedir = "/var/www/html/:/tmp/"

# Example: block PHP execution in uploads (Apache .htaccess)
<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>