The vulnerability CVE-2025-30890 affects the Login Widget for Ultimate Member plugin by SuitePlugins, allowing an attacker to exploit improper control over filenames used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, enabling an attacker with low privileges and no user interaction to potentially execute arbitrary code or access sensitive files. The CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The affected versions include all up to and including 1.1.2. There is no cloud service aspect, and no patch or vendor advisory is currently available.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could include local files via the vulnerable PHP include/require statement, potentially leading to arbitrary code execution or disclosure of sensitive information. The high CVSS score reflects the severity of these impacts. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin if feasible. Monitor SuitePlugins' official channels for updates or patches addressing this vulnerability. Avoid exposing the affected system to untrusted networks or users to reduce risk.