CVE-2025-23937
Published: 26 March 2025
Description
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Security Summary
CVE-2025-23937 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion (CWE-98), that enables PHP Local File Inclusion in the LinkedIn Lite WordPress plugin developed by Alex Furr. This issue affects all versions of the plugin from n/a through 1.0. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
Unauthenticated remote attackers can exploit this vulnerability over the network without requiring user interaction, though exploitation demands high attack complexity. Successful attacks can result in high confidentiality, integrity, and availability impacts, allowing attackers to include and execute arbitrary local files on the server, which may lead to sensitive data exposure or remote code execution depending on server configuration and accessible files.
The Patchstack advisory provides details on this WordPress plugin vulnerability, including mitigation guidance, available at https://patchstack.com/database/Wordpress/Plugin/linkedin-lite/vulnerability/wordpress-linkedin-lite-plugin-1-0-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The LFI vulnerability in a public-facing WordPress plugin directly enables remote exploitation of the application for initial access (T1190) and arbitrary local file reads for data exposure (T1005), with potential for RCE under certain conditions.