CVE-2025-30782: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability (CVE-2025-30782) was discovered in WP Shuffle Subscribe to Download Lite WordPress plugin affecting versions through 1.2.9. The vulnerability was reported by researcher LVT-tholv2k on March 10, 2025, and was publicly disclosed on March 29, 2025. The issue is classified as an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability (Patchstack).

The vulnerability is categorized under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It received a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability requires Subscriber-level privileges or higher to exploit (Patchstack).

This vulnerability could allow a malicious actor to include local files of the target website and display their contents. Particularly concerning is the potential access to files containing sensitive information such as database credentials, which could lead to a complete database takeover depending on the configuration (Patchstack).

Users are advised to update to version 1.3.0 or later to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to a fixed version (Patchstack).