PHP Remote File Inclusion Vulnerability Found in WP Shuffle Subscribe to Download Lite

CVE-2025-30785

What is CVE-2025-30785?

The WP Shuffle Subscribe to Download Lite plugin is susceptible to a PHP Local File Inclusion vulnerability that could allow unauthorized access to sensitive files on the server. This vulnerability arises from improper handling of filenames in include or require statements, potentially leading to exposure of sensitive information or system compromise. It affects all versions of the plugin from n/a through 1.2.9, necessitating immediate updates and a review of security practices by administrators.

References