CVE-2025-23952: Custom Field List Widget LFI Vulnerability

CVE-2025-23952 Overview

CVE-2025-23952 is a Local File Inclusion (LFI) vulnerability affecting the custom-field-list-widget WordPress plugin developed by ntm. This vulnerability arises from improper control of filename parameters used in PHP include/require statements, allowing attackers to include arbitrary local files from the server's filesystem.

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which describes scenarios where user-controlled input is insufficiently validated before being used in PHP file inclusion operations. Successful exploitation could allow an attacker to read sensitive files, execute arbitrary PHP code present on the server, or chain with other vulnerabilities for more severe attacks.

Critical Impact

Attackers can exploit this LFI vulnerability to read sensitive configuration files, access database credentials, or potentially achieve remote code execution by including files containing attacker-controlled content such as log files or uploaded images with embedded PHP code.

Affected Products

• custom-field-list-widget WordPress plugin versions from n/a through 1.5.1
• WordPress installations using the vulnerable plugin versions
• Web servers hosting affected WordPress sites

Discovery Timeline

• 2025-03-26 - CVE-2025-23952 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23952

Vulnerability Analysis

This Local File Inclusion vulnerability exists within the custom-field-list-widget WordPress plugin due to insufficient input validation on user-supplied parameters that are subsequently passed to PHP file inclusion functions. The plugin fails to properly sanitize or restrict the filename parameter, allowing attackers to manipulate the include path to access files outside the intended directory scope.

The attack is network-accessible without requiring any authentication or user interaction, though exploitation complexity is considered high due to the specific conditions required to successfully leverage the vulnerability. Successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of this vulnerability is the plugin's failure to implement proper input validation and path sanitization when handling user-supplied input that controls file inclusion paths. The code accepts user input that directly or indirectly influences which file gets included by PHP's include() or require() functions without adequately restricting the input to a safe set of allowed files or directories.

Common issues that contribute to this type of vulnerability include:

• Lack of allowlist validation for permitted filenames
• Missing path traversal sequence filtering (e.g., ../)
• Insufficient use of PHP's basename() or realpath() functions to normalize paths
• Reliance on blocklist approaches that can be bypassed

Attack Vector

The vulnerability is exploitable over the network by sending crafted HTTP requests to the WordPress installation hosting the vulnerable plugin. An attacker can manipulate input parameters to include arbitrary local files from the server's filesystem using path traversal sequences.

Typical exploitation scenarios include:

1. Configuration File Disclosure: Including files like /etc/passwd or wp-config.php to extract sensitive information such as database credentials
2. Log File Poisoning: First injecting PHP code into server logs via crafted requests, then including the log file to execute the injected code
3. Session File Inclusion: Including PHP session files to hijack authenticated sessions or extract session data
4. Wrapper Protocol Abuse: Using PHP wrapper protocols like php://filter to read and base64-encode source code files

For detailed technical information about this vulnerability, refer to the Patchstack WordPress Vulnerability advisory.

Detection Methods for CVE-2025-23952

Indicators of Compromise

• Web server access logs containing path traversal sequences such as ../, ..%2f, or ..%252f in requests targeting custom-field-list-widget plugin endpoints
• HTTP requests with encoded traversal patterns targeting WordPress plugin directories (e.g., /wp-content/plugins/custom-field-list-widget/)
• Unusual file access patterns in server logs indicating attempts to read system files like /etc/passwd or wp-config.php
• PHP error logs showing failed file inclusion attempts or warnings about non-existent files outside the plugin directory

Detection Strategies

• Configure Web Application Firewalls (WAF) to detect and block requests containing path traversal sequences and null bytes targeting WordPress plugin endpoints
• Implement file integrity monitoring to detect unauthorized access to sensitive configuration files
• Deploy log analysis rules to identify patterns indicative of LFI exploitation attempts, including repeated requests with varying traversal depths
• Use WordPress security plugins that monitor and alert on suspicious plugin behavior

Monitoring Recommendations

• Enable verbose logging for WordPress and PHP to capture detailed information about file inclusion operations
• Monitor for unusual read operations on sensitive files that should not be accessed by the web server
• Set up alerting for rapid successive requests to plugin endpoints with varying parameters
• Implement egress monitoring to detect potential data exfiltration following successful file disclosure

How to Mitigate CVE-2025-23952

Immediate Actions Required

• Immediately deactivate and remove the custom-field-list-widget plugin from all WordPress installations until a patched version is available
• Audit WordPress installations to identify all sites running the vulnerable plugin version (<= 1.5.1)
• Review web server access logs for signs of exploitation attempts
• Rotate any credentials that may have been exposed, particularly database passwords stored in wp-config.php

Patch Information

At the time of publication, no patched version has been confirmed. Organizations should monitor the Patchstack vulnerability database for updates regarding security patches or vendor advisories.

If the plugin is essential to operations, consider reaching out to the plugin developer (ntm) directly regarding remediation timelines. Otherwise, evaluate alternative WordPress plugins that provide similar functionality with active security maintenance.

Workarounds

• Disable or remove the custom-field-list-widget plugin entirely until a security patch is released
• Implement Web Application Firewall (WAF) rules to block requests containing path traversal sequences targeting the plugin
• Restrict file system permissions to limit the web server's read access to only necessary directories
• Use PHP's open_basedir configuration directive to restrict PHP's file access to the WordPress installation directory

# Apache/nginx configuration to block path traversal attempts
# Add to .htaccess or nginx configuration

# Apache - Block requests with path traversal sequences
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC,OR]
    RewriteCond %{REQUEST_URI} (\.\./|\.\.\\) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# PHP open_basedir restriction in php.ini or .htaccess
# php_value open_basedir /var/www/html/wordpress:/tmp