CVE-2025-30635: WordPress IDonatePro <= 2.1.9 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeAtelier IDonatePro allows PHP Local File Inclusion. This issue affects IDonatePro: from n/a through 2.1.9.
Other sources
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeAtelier IDonatePro idonate-pro allows PHP Local File Inclusion.This issue affects IDonatePro: from n/a through <= 2.1.9.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30635?
CVE-2025-30635 is classified as a critical vulnerability due to its potential for remote file inclusion and local file inclusion.
How do I fix CVE-2025-30635?
To fix CVE-2025-30635, update ThemeAtelier IDonatePro to the latest version or at least to version 2.1.10 or above.
Who is affected by CVE-2025-30635?
CVE-2025-30635 affects users of ThemeAtelier IDonatePro versions up to and including 2.1.9.
What type of vulnerability is CVE-2025-30635?
CVE-2025-30635 is an Improper Control of Filename for Include/Require Statement vulnerability, also known as PHP Remote File Inclusion.
What are the potential impacts of CVE-2025-30635?
The potential impacts of CVE-2025-30635 include unauthorized file execution and potentially complete system compromise.