CVE-2025-30820: WishSuite Path Traversal Vulnerability

CVE-2025-30820 Overview

CVE-2025-30820 is a PHP Local File Inclusion (LFI) vulnerability in the HT Plugins WishSuite WordPress plugin. The flaw stems from improper control of filenames used in PHP include or require statements [CWE-98]. Attackers with low-privilege authenticated access can manipulate file path parameters to include arbitrary local files on the server. The vulnerability affects all WishSuite versions up to and including 1.4.4. Successful exploitation can lead to source code disclosure, sensitive configuration file exposure, and potential remote code execution when combined with file upload functionality.

Critical Impact
Authenticated attackers can include arbitrary PHP files on the WordPress host, exposing credentials, configuration data, and enabling potential code execution paths.

Affected Products

HT Plugins WishSuite plugin for WordPress
WishSuite versions from n/a through 1.4.4
WordPress sites with WishSuite plugin installed and active

Discovery Timeline

2025-03-27 - CVE-2025-30820 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30820

Vulnerability Analysis

The WishSuite plugin fails to properly validate user-supplied input passed to PHP file inclusion functions. The vulnerability is classified under [CWE-98] for improper control of filenames in PHP include and require statements. While the original CWE category includes Remote File Inclusion (RFI), this specific instance is exploitable as Local File Inclusion (LFI), allowing attackers to reference files on the local filesystem.

The attack requires authenticated access with low privileges, which is common in multi-user WordPress environments with subscriber or contributor roles. The EPSS score of 1.65% places this vulnerability in the 82nd percentile for likelihood of exploitation activity.

Root Cause

The root cause is missing sanitization and validation of file path parameters before they reach PHP inclusion statements. The plugin passes user-controllable data directly to include, require, include_once, or require_once calls without enforcing a whitelist of permitted files or validating that paths remain within an expected directory.

Attack Vector

An authenticated attacker sends a crafted HTTP request to a vulnerable WishSuite endpoint with a manipulated file path parameter. By using path traversal sequences such as ../../, the attacker can reference files outside the plugin directory. Common targets include wp-config.php for database credentials, log files for session tokens, and PHP session files for privilege escalation. Detailed exploitation context is available in the Patchstack WordPress Plugin Vulnerability advisory.

Detection Methods for CVE-2025-30820

Indicators of Compromise

HTTP requests to WishSuite plugin endpoints containing path traversal patterns such as ../ or URL-encoded equivalents like %2e%2e%2f
Web server access logs showing references to wp-config.php, /etc/passwd, or PHP session files via plugin parameters
Unexpected PHP errors related to include or require failures in WordPress debug logs
Outbound connections from the web server following inclusion of attacker-controlled files

Detection Strategies

Inspect WordPress access logs for requests targeting WishSuite endpoints with suspicious file path parameters
Deploy web application firewall rules that flag path traversal sequences in query strings and POST bodies
Monitor for anomalous file read operations originating from the PHP worker process
Correlate authentication events with subsequent file inclusion requests from the same user session

Monitoring Recommendations

Enable WordPress audit logging to record plugin parameter values for low-privileged user actions
Forward web server and PHP error logs to a centralized SIEM for retention and correlation
Alert on access attempts to sensitive files such as wp-config.php from non-administrative contexts
Track plugin version inventory across WordPress sites to identify hosts running WishSuite 1.4.4 or earlier

How to Mitigate CVE-2025-30820

Immediate Actions Required

Identify all WordPress installations running the WishSuite plugin and document current versions
Update WishSuite to a version newer than 1.4.4 once a vendor-supplied patch is available
Restrict access to WordPress accounts with content contribution privileges and audit existing user roles
Review web server logs for prior exploitation attempts referencing WishSuite endpoints

Patch Information

The vulnerability affects WishSuite versions through 1.4.4. Refer to the Patchstack advisory for the latest patched version information and vendor remediation guidance.

Workarounds

Deactivate and remove the WishSuite plugin until a patched version is installed
Apply web application firewall rules that block path traversal patterns in plugin requests
Enforce least-privilege user roles and disable open registration on affected WordPress sites
Set restrictive filesystem permissions on wp-config.php and other sensitive configuration files

bash

# Example WAF rule pattern to block path traversal in WishSuite requests
# ModSecurity rule blocking common LFI sequences
SecRule REQUEST_URI "@contains wishsuite" \
    "chain,deny,status:403,id:1009820,msg:'CVE-2025-30820 LFI attempt'"
    SecRule ARGS "@rx (\.\./|%2e%2e%2f|wp-config\.php)" "t:lowercase"