CVE-2025-30849: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability (CVE-2025-30849) was discovered in g5theme Essential Real Estate WordPress plugin affecting versions through 5.2.0. The vulnerability was reported on March 2, 2025, and publicly disclosed on March 27, 2025. The issue is classified as an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability (Patchstack).

The vulnerability is categorized as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It received a CVSS v3.1 Base Score of 8.1 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability can be exploited without authentication, making it particularly dangerous (Patchstack).

The vulnerability could allow malicious actors to include local files of the target website and display their contents. This could potentially expose sensitive information, including database credentials, which might lead to complete database compromise depending on the system configuration (Patchstack).

The vulnerability is considered highly dangerous and is expected to become mass exploited. It can be triggered without authentication, making it particularly accessible to attackers. Hackers typically automate attacks against such vulnerabilities to compromise as many websites as possible before users have time to patch and update (Patchstack).

The vulnerability has been fixed in version 5.2.1 of the Essential Real Estate plugin. Users are strongly advised to update to version 5.2.1 or later immediately. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).