PHP Remote File Inclusion Vulnerability Found in WP Shuffle Subscribe to Download Lite
CVE-2025-30785

7.5HIGH

Key Information:

Vendor

WordPress
Status
Subscribe To Download Lite
Vendor
CVE Published:
27 March 2025

What is CVE-2025-30785?

The WP Shuffle Subscribe to Download Lite plugin is susceptible to a PHP Local File Inclusion vulnerability that could allow unauthorized access to sensitive files on the server. This vulnerability arises from improper handling of filenames in include or require statements, potentially leading to exposure of sensitive information or system compromise. It affects all versions of the plugin from n/a through 1.2.9, necessitating immediate updates and a review of security practices by administrators.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Subscribe to Download Lite <= 1.2.9

References

https://patchstack.com/database/wordpress/plugin/subscrib...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LVT-tholv2k (Patchstack Alliance)
JSON
.