CVE-2025-30999: External Store for Shopify LFI Vulnerability

CVE-2025-30999 Overview

CVE-2025-30999 is a Local File Inclusion (LFI) vulnerability in the Fahad Mahmood External Store for Shopify (wp-shopify) WordPress plugin. The flaw stems from improper control of a filename used in a PHP include or require statement [CWE-98]. Authenticated attackers can supply manipulated input to load arbitrary local files through the plugin's PHP code. The issue affects all versions of the plugin up to and including 1.5.9. Successful exploitation impacts confidentiality, integrity, and availability of the WordPress site. The vulnerability was published to the National Vulnerability Database (NVD) on June 6, 2025.

Critical Impact
An authenticated attacker can include arbitrary PHP files on the server, leading to sensitive data disclosure and potential remote code execution within the WordPress runtime.

Affected Products

Fahad Mahmood External Store for Shopify (wp-shopify) plugin versions up to and including 1.5.9
WordPress installations with the vulnerable plugin enabled
Hosting environments serving the plugin without virtual patching

Discovery Timeline

2025-06-06 - CVE-2025-30999 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30999

Vulnerability Analysis

The vulnerability is classified under [CWE-98]: Improper Control of Filename for Include/Require Statement in PHP Program. The plugin passes user-controllable input into a PHP file inclusion function without proper validation or canonicalization. While the original CWE description references PHP Remote File Inclusion (RFI), the impact in this case is Local File Inclusion. Attackers can reference files already present on the server, including configuration files, logs, or uploaded content. When PHP processes the included file, any PHP code inside is executed in the context of the WordPress process.

Root Cause

The root cause is missing input sanitization on a parameter used inside an include, require, include_once, or require_once call within the wp-shopify plugin code. Without an allowlist of permitted files or strict path normalization, attacker-supplied values reach the file system layer. Path components such as ../ traversal sequences or absolute file paths can redirect the include to unintended locations.

Attack Vector

The attack vector is network-based and requires low privileges, meaning the attacker must hold a valid authenticated session on the target WordPress site. The attacker issues a crafted HTTP request to a plugin endpoint that consumes the vulnerable parameter. The PHP interpreter then loads and executes the referenced local file. Where the attacker can plant PHP content in a writable location, for example via media uploads or log poisoning, the LFI can pivot to arbitrary code execution. Refer to the Patchstack WP Shopify Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-30999

Indicators of Compromise

Web server access logs showing requests to wp-shopify plugin endpoints containing path traversal sequences such as ../, encoded variants like %2e%2e%2f, or absolute paths like /etc/passwd.
Unexpected PHP include or require errors referencing files outside the plugin directory in PHP error logs.
Newly created or modified PHP files in wp-content/uploads/ or other writable directories.
Outbound network connections from the web server process to unexpected hosts following suspicious plugin requests.

Detection Strategies

Inspect HTTP request parameters delivered to wp-shopify routes for filesystem path patterns and null byte injections.
Correlate authenticated user sessions with abnormal plugin parameter values to flag low-privilege accounts performing reconnaissance.
Hash and baseline plugin files; alert on inclusion of files outside the expected plugin code path.
Deploy web application firewall (WAF) signatures targeting LFI patterns on WordPress plugin endpoints.

Monitoring Recommendations

Forward WordPress, PHP-FPM, and web server logs to a centralized analytics platform for retention and search.
Monitor for the creation of PHP files inside upload directories and other non-code paths.
Track process lineage of the PHP worker for unexpected child processes such as shells or network utilities.
Alert on access to sensitive files like wp-config.php through include-style parameter values.

How to Mitigate CVE-2025-30999

Immediate Actions Required

Disable the External Store for Shopify (wp-shopify) plugin until a patched release is verified.
Audit all WordPress user accounts and revoke unnecessary low-privilege roles that could be abused to reach the vulnerable endpoint.
Rotate WordPress secrets in wp-config.php, database credentials, and any API keys reachable from the web root.
Review web server, PHP, and WordPress logs for the indicators listed above going back to the plugin installation date.

Patch Information

No fixed version is identified in the NVD record at the time of publication. The advisory states the issue affects External Store for Shopify from n/a through <= 1.5.9. Administrators should monitor the Patchstack advisory and the WordPress plugin repository for an updated release and apply it immediately once available.

Workarounds

Remove or deactivate the wp-shopify plugin until a confirmed fixed version is released.
Apply WAF rules that block path traversal sequences and absolute paths in query parameters reaching the plugin.
Set PHP open_basedir to restrict file inclusion to the WordPress installation directory.
Disable PHP execution inside wp-content/uploads/ using web server configuration to limit pivot from LFI to RCE.

bash

# Configuration example: restrict PHP execution and apply open_basedir
# Apache: block PHP execution in uploads
<Directory "/var/www/html/wp-content/uploads">
    php_admin_flag engine off
    <FilesMatch "\.(php|phtml|php5|php7)$">
        Require all denied
    </FilesMatch>
</Directory>

# php.ini: constrain file system access for the WordPress vhost
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off
allow_url_fopen = Off