CVE-2025-30849: G5plus Essential Real Estate LFI Vulnerability

CVE-2025-30849 Overview

CVE-2025-30849 is a Local File Inclusion (LFI) vulnerability affecting the Essential Real Estate WordPress plugin developed by G5plus. The vulnerability stems from improper control of filename parameters used in PHP include/require statements, allowing attackers to include arbitrary local files on the server. This flaw enables unauthenticated remote attackers to potentially read sensitive configuration files, access credentials, or escalate the attack to achieve remote code execution under certain conditions.

Critical Impact

This vulnerability allows unauthenticated attackers to include and execute arbitrary local PHP files on WordPress installations running the vulnerable plugin, potentially leading to complete site compromise.

Affected Products

• G5plus Essential Real Estate plugin versions up to and including 5.2.0
• WordPress installations running vulnerable versions of the Essential Real Estate plugin
• All WordPress sites with Essential Real Estate plugin from n/a through 5.2.0

Discovery Timeline

• 2025-04-01 - CVE-2025-30849 published to NVD
• 2025-05-27 - Last updated in NVD database

Technical Details for CVE-2025-30849

Vulnerability Analysis

This vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) and CWE-706 (Use of Incorrectly-Resolved Name or Reference). The Essential Real Estate plugin fails to properly validate and sanitize user-supplied input before using it in PHP file inclusion operations. This allows attackers to manipulate file path parameters to include arbitrary files from the local filesystem.

Local File Inclusion vulnerabilities in WordPress plugins are particularly dangerous because they can expose sensitive configuration files such as wp-config.php, which contains database credentials and authentication keys. Furthermore, if combined with other techniques like log poisoning or file upload functionality, LFI can be escalated to achieve Remote Code Execution.

Root Cause

The root cause of CVE-2025-30849 lies in insufficient input validation within the Essential Real Estate plugin's PHP code. When the plugin processes user-controllable input to determine which file to include via PHP's include() or require() functions, it fails to adequately sanitize path traversal sequences or restrict the allowable file paths. This allows attackers to craft malicious requests containing directory traversal sequences (e.g., ../) to escape the intended directory and access files elsewhere on the filesystem.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication, user interaction, or special privileges. Attackers can craft HTTP requests to the vulnerable WordPress site containing manipulated parameters that reference local files. By leveraging path traversal techniques, an attacker can navigate the directory structure to include sensitive files.

A typical attack scenario involves:

1. Identifying a WordPress site running the vulnerable Essential Real Estate plugin
2. Crafting a malicious request with path traversal sequences targeting sensitive files
3. The plugin includes the specified file, exposing its contents or executing PHP code
4. Attackers extract credentials, configuration data, or chain with other techniques for code execution

Technical exploitation details can be found in the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2025-30849

Indicators of Compromise

• Unusual HTTP requests to the Essential Real Estate plugin endpoints containing path traversal sequences such as ../ or encoded variants
• Web server logs showing requests with suspicious file path parameters targeting system files like /etc/passwd or wp-config.php
• Unexpected file access patterns in PHP error logs indicating attempted file inclusion outside the plugin directory
• Evidence of unauthorized access to sensitive WordPress configuration files

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block path traversal patterns in HTTP requests
• Enable detailed logging for the WordPress site and monitor for requests containing ../, ..%2f, or similar encoded traversal sequences
• Implement file integrity monitoring to detect unauthorized access or modification of sensitive files
• Utilize WordPress security plugins to scan for known vulnerable plugin versions

Monitoring Recommendations

• Monitor web server access logs for anomalous requests targeting the Essential Real Estate plugin
• Set up alerts for repeated failed file inclusion attempts or unusual error patterns in PHP logs
• Track plugin version changes and correlate with security advisories
• Implement real-time threat detection for WordPress installations using endpoint security solutions like SentinelOne

How to Mitigate CVE-2025-30849

Immediate Actions Required

• Update the Essential Real Estate plugin to a patched version immediately if one is available from the vendor
• If no patch is available, consider temporarily deactivating the Essential Real Estate plugin until a fix is released
• Implement WAF rules to block requests containing path traversal patterns targeting the plugin
• Review web server logs for evidence of exploitation attempts and investigate any suspicious activity
• Audit file permissions to restrict access to sensitive configuration files

Patch Information

At the time of this writing, organizations should consult the Patchstack WordPress Vulnerability Report for the latest patch availability and remediation guidance from G5plus. Ensure the plugin is updated to a version newer than 5.2.0 once a security patch is released.

Workarounds

• Disable the Essential Real Estate plugin temporarily until a patch is available
• Implement server-level restrictions using .htaccess or nginx configuration to block suspicious requests
• Use a Web Application Firewall to filter requests containing path traversal patterns
• Restrict PHP's open_basedir directive to limit file inclusion to specific directories

# Example .htaccess rule to block path traversal attempts
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC,OR]
    RewriteCond %{QUERY_STRING} (\.\.%2f|\.\.%5c) [NC]
    RewriteRule .* - [F,L]
</IfModule>