CVE-2025-30890: Ultimate Member Login Widget LFI Flaw

CVE-2025-30890 Overview

CVE-2025-30890 is a PHP Local File Inclusion (LFI) vulnerability in the SuitePlugins Login Widget for Ultimate Member WordPress plugin. The flaw stems from improper control of the filename used in PHP include or require statements [CWE-98]. Authenticated attackers with low privileges can manipulate file path parameters to load arbitrary local PHP files. Successful exploitation can expose sensitive configuration data, execute unintended PHP code paths, and compromise the host application. The vulnerability affects all versions of the plugin up to and including 1.1.2.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, leading to information disclosure and potential code execution within the WordPress environment.

Affected Products

SuitePlugins Login Widget for Ultimate Member plugin for WordPress
All versions from initial release through 1.1.2
WordPress sites running the Ultimate Member ecosystem with this widget enabled

Discovery Timeline

2025-03-27 - CVE-2025-30890 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30890

Vulnerability Analysis

The plugin accepts user-controlled input that is passed into a PHP include or require statement without proper sanitization or allow-list validation. This pattern, classified as [CWE-98], allows attackers to traverse the filesystem and force the PHP interpreter to load files outside the intended directory. The Patchstack advisory confirms the issue as a Local File Inclusion condition affecting plugin versions through 1.1.2. While the attack vector is network-based, exploitation requires low-privileged authentication and elevated complexity, narrowing the attacker pool but not eliminating risk. Successful inclusion of files such as wp-config.php or attacker-controlled uploads can expose database credentials and lead to further compromise.

Root Cause

The root cause is missing input validation on a file path parameter consumed by a dynamic include/require call. The plugin does not enforce a whitelist of permitted templates or normalize traversal sequences such as ../. Any string passed by an authenticated user is concatenated into a filesystem path and executed as PHP.

Attack Vector

An authenticated user issues a crafted HTTP request to the vulnerable plugin endpoint, supplying a manipulated file path parameter. The PHP interpreter resolves the path and executes the referenced file in the context of the web server. Refer to the Patchstack Vulnerability Report for exploitation conditions.

// No verified public exploit code is available for CVE-2025-30890.
// See the Patchstack advisory for technical details.

Detection Methods for CVE-2025-30890

Indicators of Compromise

HTTP requests to plugin endpoints containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f in query or POST parameters.
Unexpected PHP errors or warnings referencing include() or require() failures in web server logs.
Web server access to sensitive files such as wp-config.php, /etc/passwd, or other non-template paths through plugin URLs.

Detection Strategies

Inspect WordPress access logs for requests to login-widget-for-ultimate-member endpoints with suspicious file path parameters.
Deploy web application firewall (WAF) rules that flag traversal patterns and absolute paths in plugin parameters.
Correlate authenticated session activity with anomalous file-read errors generated by the PHP runtime.

Monitoring Recommendations

Enable verbose PHP error logging temporarily to capture failed inclusion attempts during incident triage.
Monitor file integrity on wp-content/plugins/login-widget-for-ultimate-member/ for unauthorized changes.
Alert on outbound connections initiated by the PHP process that deviate from baseline behavior.

How to Mitigate CVE-2025-30890

Immediate Actions Required

Disable or remove the Login Widget for Ultimate Member plugin until a fixed version is installed.
Restrict WordPress role assignments so untrusted users cannot reach authenticated plugin endpoints.
Audit logs for prior exploitation attempts against the vulnerable plugin path.

Patch Information

At the time of publication, the Patchstack advisory lists all versions up to and including 1.1.2 as affected. Administrators should consult the Patchstack Vulnerability Report and the plugin vendor for the latest patched release. Update immediately once a fixed version is available.

Workarounds

Remove the plugin directory wp-content/plugins/login-widget-for-ultimate-member/ if the widget is not business-critical.
Enforce WAF rules that block path traversal sequences and absolute paths in plugin request parameters.
Apply filesystem permissions that prevent the web server user from reading sensitive configuration files outside the WordPress webroot.

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate login-widget-for-ultimate-member
wp plugin delete login-widget-for-ultimate-member