The vulnerability CVE-2025-30846 affects the jetmonsters Restaurant Menu by MotoPress plugin for WordPress, specifically versions up to 2.4.4. It arises from improper control over the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This can allow an attacker with at least limited privileges (PR:L) to include arbitrary files on the server, potentially leading to remote code execution or disclosure of sensitive information. The vulnerability is exploitable remotely over the network without user interaction and impacts confidentiality, integrity, and availability with high severity (CVSS 8.8). There is no vendor-provided patch or advisory linked in the data, and no exploits are known in the wild at this time.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive files, execution of arbitrary code, and disruption of service. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability. Since the vulnerability allows local file inclusion via PHP include/require statements, attackers may leverage this to escalate privileges or move laterally within the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version if possible. Restricting file permissions and limiting user privileges may reduce risk but do not fully mitigate the vulnerability. Monitor official MotoPress or jetmonsters channels for updates and apply patches promptly once available.