PT-2025-13095 · Ht Plugins · Ht Plugins Wishsuite

Lvt-Tholv2K · Published 2025-03-27 · Updated 2025-04-01 · CVE-2025-30820

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HT Plugins WishSuite versions 1.4.4 and earlier

Description The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This is a type of security vulnerability that can be exploited by an attacker to include and execute arbitrary PHP files, potentially leading to code execution and other malicious activities.

Recommendations For HT Plugins WishSuite versions 1.4.4 and earlier, update to a version that fixes this issue, as using an outdated version poses a significant security risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-30820

Affected Products

Ht Plugins Wishsuite

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-30820 · Security Note
• https://twitter.com/cybercronai/status/1905500547303481826 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/wishsuite/vulnerability/wordpress-wishsuite-plugin-1-4-4-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/wishsuite/vulnerability/wordpress-wishsuite-plugin-1-4-4-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1905220137952686194 · Twitter Post
• https://twitter.com/cracbot/status/1907025219669139476 · Twitter Post