CVE-2025-30829: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability (CVE-2025-30829) was discovered in the Themewinter WPCafe WordPress plugin affecting versions through 2.2.31. The vulnerability was disclosed on March 27, 2025, and allows authenticated users with Contributor-level access to perform PHP Local File Inclusion attacks (NVD, Patchstack).

The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) with a CVSS v3.1 base score of 7.5 (High). The attack vector is network-based (AV:N) with high attack complexity (AC:H), requiring low privileges (PR:L) and no user interaction (UI:N). The scope is unchanged (S:U) with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) (NVD).

This vulnerability could allow a malicious actor to include local files of the target website and display their contents. Files containing sensitive information, such as database credentials, could potentially be exposed, leading to a complete database takeover depending on the configuration (Patchstack).

The vulnerability requires an authenticated user with at least Contributor-level access to exploit. Despite its high CVSS score, Patchstack has classified this as a low-priority issue that is unlikely to be exploited (Patchstack).

The vulnerability has been patched in version 2.2.32 of the WPCafe plugin. Users are advised to update to version 2.2.32 or later to remove the vulnerability. Patchstack users can enable auto-update functionality for vulnerable plugins (Patchstack).