The vulnerability CVE-2025-30814 in RadiusTheme The Post Grid plugin arises from improper validation of filenames used in PHP include or require statements. This allows an attacker with limited privileges to perform Local File Inclusion (LFI), which can lead to disclosure of sensitive files, code execution, or denial of service. The issue affects versions up to and including 7.7.17. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring high attack complexity and low privileges without user interaction.

Successful exploitation could lead to disclosure of sensitive local files, unauthorized code execution, and disruption of service on affected installations of The Post Grid plugin. The attacker requires low privileges but must overcome high attack complexity. The overall impact is high on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and consider disabling it if not essential. Monitor for updates from RadiusTheme and apply patches promptly once available.