CVE-2025-30868: WP Team Manager LFI Vulnerability

CVE-2025-30868 Overview

CVE-2025-30868 is a PHP Local File Inclusion (LFI) vulnerability in the Maidul Team Manager (wp-team-manager) WordPress plugin. The flaw stems from improper control of filenames used in PHP include or require statements, classified under [CWE-98]. Affected versions include all releases of Team Manager from the initial version through 2.1.23. An authenticated attacker with low privileges can abuse the vulnerability to load arbitrary local PHP files into the application context. Successful exploitation impacts confidentiality, integrity, and availability of the WordPress site.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, potentially leading to code execution, sensitive file disclosure, and full site compromise.

Affected Products

Maidul Team Manager (wp-team-manager) plugin for WordPress
All versions from initial release through 2.1.23
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2025-03-27 - CVE-2025-30868 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30868

Vulnerability Analysis

The vulnerability resides in the Team Manager plugin's handling of filenames passed into PHP include or require constructs. The plugin fails to validate or sanitize user-controllable input before using it to resolve a file path. PHP then loads and executes the referenced file in the application context. This category of flaw is tracked as [CWE-98] (Improper Control of Filename for Include/Require Statement). The EPSS model places the probability of exploitation at roughly 1.65 percent, in the 82nd percentile.

Root Cause

The plugin accepts attacker-influenced data and concatenates it into a path used by include or require. Without an allowlist of permitted files or canonicalization of the resolved path, the include resolves to arbitrary locations on the server filesystem. Any local PHP file readable by the web server can be executed through this include sink.

Attack Vector

The attack vector is network-based and requires low-privilege authentication on the target WordPress site. An attacker submits a crafted request containing a manipulated filename parameter to a vulnerable plugin endpoint. The server resolves the path and includes the referenced file, executing any PHP it contains. Depending on the server configuration, attackers can chain the LFI with log poisoning, session files, or uploaded media to achieve remote code execution.

No public proof-of-concept exploit code has been released. Technical details are documented in the Patchstack Plugin Vulnerability Report.

Detection Methods for CVE-2025-30868

Indicators of Compromise

Web access logs containing requests to wp-team-manager endpoints with path traversal sequences such as ../ or absolute paths in parameter values.
Unexpected PHP files appearing in upload directories or temporary paths shortly before suspicious include activity.
Access to sensitive system files like /etc/passwd, wp-config.php, or PHP session files through plugin endpoints.
WordPress audit logs showing low-privilege accounts triggering plugin actions outside their normal scope.

Detection Strategies

Inspect HTTP request parameters sent to the Team Manager plugin for filesystem metacharacters and directory traversal patterns.
Monitor PHP include, require, and file_get_contents calls referencing paths derived from request input.
Correlate authenticated WordPress sessions with anomalous plugin activity and outbound connections from the web host.
Compare the file inventory of wp-content/plugins/wp-team-manager/ against the upstream release to detect tampering.

Monitoring Recommendations

Enable verbose web server logging and forward logs to a central SIEM for analysis of plugin request patterns.
Alert on HTTP 200 responses to plugin endpoints that return content sizes inconsistent with normal plugin behavior.
Track new low-privilege WordPress accounts and flag rapid escalation in plugin endpoint usage.

How to Mitigate CVE-2025-30868

Immediate Actions Required

Deactivate the Team Manager plugin on any WordPress site running version 2.1.23 or earlier until a fixed release is installed.
Restrict authentication to the WordPress admin area and audit all low-privilege accounts for unexpected activity.
Deploy a web application firewall rule that blocks path traversal sequences in requests to wp-team-manager endpoints.
Review web server and PHP error logs for prior exploitation attempts referencing local file paths.

Patch Information

At the time of publication, the Patchstack advisory lists all versions up to and including 2.1.23 as affected. Administrators should monitor the Patchstack Plugin Vulnerability Report and the WordPress plugin repository for an updated release that sanitizes include paths.

Workarounds

Remove the wp-team-manager plugin directory if the plugin is not business-critical.
Enforce PHP open_basedir restrictions to limit which directories the web server process can read.
Disable allow_url_include in php.ini and ensure allow_url_fopen is set to Off where feasible.
Apply virtual patching at the WAF layer by denying requests with .., null bytes, or absolute paths in parameters bound to the plugin.

bash

# Configuration example: harden PHP against file inclusion abuse
# /etc/php/8.x/fpm/php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Disable the vulnerable plugin via WP-CLI until a patch is available
wp plugin deactivate wp-team-manager