CVE-2025-30785: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability (CVE-2025-30785) was discovered in WP Shuffle Subscribe to Download Lite WordPress plugin affecting versions through 1.2.9. The vulnerability was reported by researcher LVT-tholv2k on March 10, 2025, and was publicly disclosed on March 27, 2025 (Patchstack).

The vulnerability is classified as an Improper Control of Filename for Include/Require Statement in PHP Program (CWE-98). It received a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility with high attack complexity, requiring low privileges, and potentially resulting in high impacts to confidentiality, integrity, and availability (Patchstack).

The vulnerability could allow a malicious actor to include local files of the target website and display their contents. This could potentially lead to exposure of sensitive information, including database credentials, which depending on the configuration could result in complete database compromise (Patchstack).

The vulnerability has been fixed in version 1.3.0 of the Subscribe to Download Lite plugin. Users are advised to update to version 1.3.0 or later to remove the vulnerability. Patchstack users have the option to enable auto-update for vulnerable plugins (Patchstack).