CVE-2025-64377
Published: 18 December 2025
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through < 2.9.10.
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the specific PHP LFI flaw in ListingPro by patching to version 2.9.10, eliminating the vulnerability.
Mandates validation of user-supplied filenames in PHP include/require statements to block improper local file inclusion.
Restricts unauthorized filenames or paths from being processed in file inclusion operations, limiting exploitation vectors.
Security SummaryAI
CVE-2025-64377 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, also known as PHP Remote File Inclusion, in the CridioStudio ListingPro WordPress theme. The flaw enables PHP Local File Inclusion and affects ListingPro versions from n/a through those prior to 2.9.10.
Unauthenticated remote attackers can exploit this vulnerability over the network, though it requires high attack complexity and no user interaction. Exploitation yields high impacts on confidentiality, integrity, and availability, resulting in a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
The Patchstack advisory details this vulnerability in the ListingPro theme and indicates it is resolved in version 2.9.10.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
This is a remote file inclusion vulnerability in a public-facing WordPress theme, directly enabling exploitation of public-facing applications for remote code execution, sensitive file access, and service disruption.