CVE-2025-30849: Essential Real Estate Path Traversal Flaw

CVE-2025-30849 Overview

CVE-2025-30849 is a Local File Inclusion (LFI) vulnerability in the g5plus Essential Real Estate plugin for WordPress. The flaw stems from Improper Control of Filename for Include/Require Statement in PHP Program, classified as [CWE-98] and [CWE-706]. Attackers can exploit the issue over the network without authentication or user interaction. The vulnerability affects all versions of Essential Real Estate up to and including 5.2.0. Successful exploitation allows attackers to include arbitrary local files in PHP execution context, leading to source code disclosure, sensitive data exposure, and in many configurations, remote code execution through log poisoning or session file abuse.

Critical Impact
Unauthenticated attackers can include local PHP files, exposing sensitive data and potentially achieving remote code execution on affected WordPress sites.

Affected Products

g5plus Essential Real Estate plugin for WordPress
All versions from initial release through 5.2.0
WordPress sites with the essential-real-estate plugin installed and active

Discovery Timeline

2025-04-01 - CVE-2025-30849 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30849

Vulnerability Analysis

The vulnerability is a PHP Local File Inclusion flaw within the Essential Real Estate WordPress plugin. The plugin passes user-controllable input to PHP include or require statements without sufficient validation or path sanitization. An unauthenticated remote attacker can craft a request that causes the plugin to load arbitrary files from the server's filesystem into the PHP interpreter.

The issue is tracked under [CWE-98] (Improper Control of Filename for Include/Require Statement) and [CWE-706] (Use of Incorrectly-Resolved Name or Reference). While the title references PHP Remote File Inclusion, the actual impact is limited to Local File Inclusion, which still allows reading of sensitive PHP files such as wp-config.php and inclusion of attacker-controlled files written through other vectors.

The EPSS probability for this CVE places it in the 80th percentile, indicating meaningful real-world exploitation likelihood for WordPress plugin LFI flaws.

Root Cause

The plugin accepts a filename or path parameter from an HTTP request and concatenates it into a PHP include or require call. Path normalization, allow-listing of permitted files, and directory restriction through open_basedir or realpath() checks are absent or insufficient. Directory traversal sequences such as ../ allow attackers to escape the intended template directory.

Attack Vector

An attacker sends a crafted HTTP request to a vulnerable endpoint exposed by the plugin. The malicious request contains a path traversal payload pointing to a sensitive file or to an attacker-controlled file written via log poisoning, session injection, or file upload through other application functionality. The included file executes within the PHP context of the WordPress site, granting access equivalent to the web server user.

No authentication is required. The vulnerability is reachable over the network with low complexity, making mass-scanning campaigns against exposed WordPress installations a realistic threat. Refer to the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-30849

Indicators of Compromise

HTTP requests to plugin endpoints under /wp-content/plugins/essential-real-estate/ containing path traversal sequences such as ../ or URL-encoded equivalents like %2e%2e%2f
Web server log entries showing parameter values referencing system files such as /etc/passwd, wp-config.php, or PHP wrappers like php://filter
Unexpected PHP errors referencing include() or require() failures with paths outside the plugin directory
Outbound connections or new files created by the www-data or PHP-FPM user shortly after suspicious plugin requests

Detection Strategies

Inspect WordPress access logs for requests to Essential Real Estate plugin endpoints containing suspicious query parameters with file paths or traversal sequences
Deploy Web Application Firewall (WAF) rules that block path traversal patterns and known LFI payloads targeting WordPress plugins
Monitor PHP error logs for failed to open stream or Permission denied errors involving plugin include statements

Monitoring Recommendations

Continuously inventory WordPress plugin versions and flag any site running Essential Real Estate version 5.2.0 or earlier
Alert on access to sensitive files such as wp-config.php from the web server process
Correlate HTTP request anomalies with subsequent process execution or file system changes on the WordPress host

How to Mitigate CVE-2025-30849

Immediate Actions Required

Identify all WordPress installations running the Essential Real Estate plugin and confirm the installed version
Deactivate the plugin on any site running version 5.2.0 or earlier until a fixed release is verified
Apply WAF rules to block path traversal and LFI payloads targeting the plugin's request endpoints
Rotate any credentials stored in wp-config.php if exploitation cannot be ruled out from log review

Patch Information

At the time of publication, the vendor advisory tracked through the Patchstack Vulnerability Report lists the issue as affecting versions up to and including 5.2.0. Administrators must upgrade to a version newer than 5.2.0 once the vendor releases a patched build and validate the fix in a staging environment before production rollout.

Workarounds

Disable and remove the Essential Real Estate plugin if a patched version is not yet available
Restrict PHP file inclusion using open_basedir directives in php.ini to confine includes to the WordPress installation directory
Configure WAF or reverse proxy rules to reject requests containing ../, php://, file://, or other LFI wrapper schemes targeting the plugin
Apply least-privilege file system permissions so the PHP process cannot read sensitive system files outside the WordPress webroot

bash

# Example php.ini hardening to limit file inclusion scope
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off

# Example nginx rule to block traversal against the plugin path
location ~* /wp-content/plugins/essential-real-estate/ {
    if ($args ~* "(\.\./|%2e%2e|php://|file://)") {
        return 403;
    }
}