The vulnerability CVE-2025-30785 affects the Subscribe to Download Lite plugin by WP Shuffle. It arises from improper validation or control of filenames used in PHP include or require statements, enabling Local File Inclusion. This can allow an attacker with limited privileges to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 score is 7.5, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized code execution, and disruption of service on the affected WordPress site. The attacker can leverage the Local File Inclusion to read arbitrary files or execute malicious code, severely impacting the confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and limit user privileges to reduce risk. Monitor for updates from WP Shuffle and apply patches promptly once released.