CVE-2025-30845 Overview
CVE-2025-30845 is a PHP Local File Inclusion (LFI) vulnerability in the webangon The Pack Elementor addons plugin for WordPress, identified as the-pack-addon. The flaw stems from improper control of filenames used in PHP include or require statements [CWE-98]. Authenticated attackers with low privileges can supply crafted input to load arbitrary local files through the plugin. All plugin versions from initial release through 2.1.1 are affected. Successful exploitation can expose sensitive server-side files and lead to code execution paths when loadable PHP content is reachable.
Critical Impact
Authenticated attackers can include arbitrary local files via the vulnerable plugin, compromising confidentiality, integrity, and availability of the WordPress host.
Affected Products
- webangon The Pack Elementor addons (the-pack-addon) — versions up to and including 2.1.1
- WordPress sites running the plugin alongside Elementor
- Hosting environments where PHP include/require resolves attacker-controlled paths
Discovery Timeline
- 2025-03-27 - CVE-2025-30845 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-30845
Vulnerability Analysis
The plugin passes user-supplied input into a PHP file inclusion call without sufficient validation or allow-listing. PHP then resolves the supplied value as a filesystem path and executes any PHP code contained in the target file. Because the inclusion executes server-side, an attacker can read configuration files, secrets, and other readable resources on the host. The Patchstack advisory categorizes the issue as Local File Inclusion rather than fully remote inclusion, indicating that allow_url_include is not required for exploitation. The attack requires authentication at a low privilege level, and exploitation complexity is elevated because the attacker must place or reference an includable file path reachable to the web process. Despite the complexity, the impact across confidentiality, integrity, and availability is high. The EPSS probability for this CVE is 2.308% at the 85.038 percentile, reflecting moderate predicted exploitation likelihood relative to the broader CVE population.
Root Cause
The root cause is unsanitized user input flowing into a PHP include/require statement within the plugin. The plugin neither validates the requested filename against an allow-list nor restricts traversal sequences, enabling arbitrary path resolution.
Attack Vector
The attack vector is network-based. An authenticated user issues an HTTP request to a plugin endpoint that maps the controlled parameter into a file inclusion sink. The included content is then parsed and executed by the PHP interpreter under the web server identity.
No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for advisory details.
Detection Methods for CVE-2025-30845
Indicators of Compromise
- Web access logs showing requests to the-pack-addon endpoints containing path traversal sequences such as ../ or absolute paths like /etc/passwd.
- Unexpected PHP include/require warnings in PHP error logs referencing plugin files.
- Outbound connections or new files originating from the wp-content/plugins/the-pack-addon/ directory.
Detection Strategies
- Inspect HTTP query strings and POST bodies sent to plugin AJAX or REST handlers for filesystem path patterns and null-byte tricks.
- Correlate authenticated WordPress sessions with anomalous file access activity on the underlying host filesystem.
- Monitor for PHP processes reading files outside the WordPress document root shortly after plugin-related requests.
Monitoring Recommendations
- Enable verbose access logging on the WordPress front controller and retain plugin endpoint requests for forensic review.
- Alert on PHP open_basedir violations and include/require failures in PHP-FPM and web server logs.
- Track plugin version inventory across WordPress sites to flag any host still running the-pack-addon<= 2.1.1.
How to Mitigate CVE-2025-30845
Immediate Actions Required
- Update the-pack-addon to a release later than 2.1.1 as soon as the vendor publishes a fixed version.
- Audit user accounts and revoke unnecessary contributor- or author-level privileges that could enable exploitation.
- Review recent web logs for prior exploitation attempts targeting the plugin's parameters.
Patch Information
The vulnerability affects The Pack Elementor addons from initial release through 2.1.1. Consult the Patchstack Vulnerability Report for the current fixed version and apply the vendor patch through the WordPress plugin update channel.
Workarounds
- Deactivate and remove the-pack-addon until a patched release is installed.
- Configure PHP open_basedir to restrict includable paths to the WordPress document root.
- Deploy a web application firewall rule that blocks path traversal patterns and absolute file paths in requests to plugin endpoints.
- Set allow_url_include=Off and allow_url_fopen=Off in php.ini to limit inclusion abuse.
# Configuration example: harden PHP against file inclusion abuse
# /etc/php/php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
# Remove the vulnerable plugin via WP-CLI until a patch is available
wp plugin deactivate the-pack-addon
wp plugin delete the-pack-addon
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
