CVE-2025-23937
Published: 26 March 2025
Summary
CVE-2025-23937 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 28.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-23937 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion (CWE-98), that enables PHP Local File Inclusion in the LinkedIn Lite WordPress plugin developed by Alex Furr. This issue affects all versions of the plugin from n/a through 1.0. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
Unauthenticated remote attackers can exploit this vulnerability over the network without requiring user interaction, though exploitation demands high attack complexity. Successful attacks can result in high confidentiality, integrity, and availability impacts, allowing attackers to include and execute arbitrary local files on the server, which may lead to sensitive data exposure or remote code execution depending on server configuration and accessible files.
The Patchstack advisory provides details on this WordPress plugin vulnerability, including mitigation guidance, available at https://patchstack.com/database/Wordpress/Plugin/linkedin-lite/vulnerability/wordpress-linkedin-lite-plugin-1-0-local-file-inclusion-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8183
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alex Furr LinkedIn Lite linkedin-lite allows PHP Local File Inclusion.This issue affects LinkedIn Lite: from n/a through <= 1.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The LFI vulnerability in a public-facing WordPress plugin directly enables remote exploitation of the application for initial access (T1190) and arbitrary local file reads for data exposure (T1005), with potential for RCE under certain conditions.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring identification, reporting, and timely patching or removal of the vulnerable LinkedIn Lite WordPress plugin.
Prevents exploitation of the PHP Local File Inclusion vulnerability by enforcing validation of filenames used in include/require statements to reject malicious paths.
Detects the presence of this specific vulnerability in the LinkedIn Lite plugin through regular scanning of web applications and third-party components.