CVE-2025-30829: WPCafe Path Traversal Vulnerability

CVE-2025-30829 Overview

CVE-2025-30829 is a PHP Local File Inclusion (LFI) vulnerability in the Arraytics WPCafe plugin for WordPress. The flaw resides in improper control of filenames used in PHP include or require statements [CWE-98]. It affects all versions of WPCafe up to and including 2.2.31. An authenticated attacker with low privileges can manipulate file path parameters to load arbitrary local PHP files on the server. Successful exploitation can disclose sensitive configuration data, execute attacker-controlled PHP code already present on the filesystem, and undermine site integrity. The vulnerability was published to the National Vulnerability Database (NVD) on March 27, 2025.

Critical Impact
An authenticated attacker can include arbitrary local PHP files, leading to information disclosure and potential code execution on the WordPress host.

Affected Products

Arraytics WPCafe (wp-cafe) plugin for WordPress
All versions from initial release through 2.2.31
WordPress sites running the vulnerable plugin in restaurant/cafe deployments

Discovery Timeline

2025-03-27 - CVE-2025-30829 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30829

Vulnerability Analysis

The vulnerability is classified as Improper Control of Filename for Include/Require Statement in PHP Program [CWE-98]. WPCafe accepts user-controlled input that is passed into a PHP include or require construct without sufficient validation against an allowlist of safe paths. As a result, an attacker can traverse the filesystem and force the PHP interpreter to load files outside the plugin directory. Because the included files are executed in the context of the WordPress process, any local .php file the web server can read becomes attacker-reachable code. The issue requires authentication and high attack complexity, which limits opportunistic exploitation, but a logged-in subscriber or contributor account is sufficient. The vulnerability carries an EPSS score in the 82nd percentile, indicating notable interest relative to other published CVEs.

Root Cause

The root cause is the absence of strict input validation and path canonicalization before a user-supplied parameter reaches a PHP file inclusion sink. The plugin trusts request data to construct a filesystem path that is then evaluated by include, require, or one of their variants.

Attack Vector

The attack vector is network-based and requires low privileges on the target WordPress site. An attacker sends a crafted HTTP request to a WPCafe endpoint, supplying a manipulated parameter that resolves to a local PHP file. The web server includes and executes that file. Refer to the Patchstack Vulnerability Report for further technical context.

Detection Methods for CVE-2025-30829

Indicators of Compromise

HTTP requests to WPCafe AJAX or REST endpoints containing path traversal sequences such as ../, ..%2f, or absolute paths like /etc/passwd.
Unexpected PHP file inclusions logged in web server access logs originating from authenticated low-privilege accounts.
Outbound or internal file reads of sensitive WordPress files such as wp-config.php from the WPCafe plugin context.

Detection Strategies

Inspect web server and WordPress debug logs for query string or POST body parameters containing filesystem traversal patterns directed at wp-cafe endpoints.
Deploy a Web Application Firewall (WAF) rule that blocks traversal sequences and absolute path values on plugin parameters.
Audit WordPress user activity logs for low-privileged accounts issuing repeated requests to WPCafe administrative actions.

Monitoring Recommendations

Forward WordPress and PHP error logs to a centralized logging platform and alert on include/require warnings referencing unexpected paths.
Monitor file access patterns on the WordPress host for reads of wp-config.php, /etc/passwd, or session files from the web server user.
Track plugin version inventory across WordPress sites and flag any host still running WPCafe <= 2.2.31.

How to Mitigate CVE-2025-30829

Immediate Actions Required

Update the Arraytics WPCafe plugin to a version newer than 2.2.31 as soon as a patched release is available from the vendor.
Audit existing WordPress accounts and remove or downgrade unnecessary low-privilege users that could be leveraged for authenticated exploitation.
Rotate WordPress secrets in wp-config.php and database credentials if exploitation is suspected.

Patch Information

Review the Patchstack Vulnerability Report for the latest fixed version guidance from Arraytics. Apply the vendor-supplied update through the WordPress plugin updater or by replacing the plugin directory with the patched release.

Workarounds

Temporarily deactivate and remove the WPCafe plugin until a patched version is installed.
Restrict access to WPCafe endpoints at the WAF or reverse proxy layer, blocking requests containing ../, null bytes, or absolute paths.
Harden PHP configuration by setting open_basedir to constrain file inclusion to the WordPress document root and plugin directories.

bash

# Example PHP hardening in php.ini or a per-vhost override
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off