The vulnerability CVE-2025-30829 affects the Arraytics WPCafe WordPress plugin up to version 2.2.31. It arises from improper control over the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion vulnerability. This can allow an attacker with limited privileges to include and execute local files on the server, potentially leading to full system compromise. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized code execution, and disruption of service on affected systems running vulnerable versions of WPCafe. Given the high CVSS score, the impact is considered severe, affecting confidentiality, integrity, and availability of the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable WPCafe plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.