CVE-2025-52715: Classified Listing File Inclusion Flaw

CVE-2025-52715 Overview

CVE-2025-52715 is a PHP Local File Inclusion (LFI) vulnerability in the RadiusTheme Classified Listing WordPress plugin. The flaw stems from improper control of filenames used in PHP include/require statements [CWE-98]. Attackers with low-level authenticated access can coerce the plugin to include arbitrary local files. Successful exploitation exposes sensitive files, enables source code disclosure, and can lead to code execution when combined with file upload primitives. The vulnerability affects Classified Listing versions up to and including 4.2.0. Patchstack published an advisory tracking this issue as a Local File Inclusion vulnerability in the plugin.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, resulting in information disclosure and potential remote code execution on the WordPress host.

Affected Products

RadiusTheme Classified Listing plugin for WordPress
Classified Listing versions from n/a through 4.2.0
WordPress sites running the vulnerable plugin as a directory or listing site

Discovery Timeline

2025-06-20 - CVE-2025-52715 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52715

Vulnerability Analysis

The plugin passes attacker-controlled input into a PHP file inclusion function without sufficient validation or allow-listing. This falls under CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program. The classification is Local File Inclusion because remote URL wrappers are not required for exploitation. The attacker supplies a filesystem path or traversal sequence, and the PHP runtime executes the referenced file within the plugin's context. The attack requires network access to the WordPress site and a low-privileged authenticated session. The EPSS probability sits at 0.375%, reflecting limited observed exploitation attempts to date.

Root Cause

The root cause is missing input validation on a parameter that reaches a dynamic include or require call. The plugin does not restrict the value to a predefined set of template files or sanitize path traversal sequences such as ../. Any file readable by the PHP process becomes a candidate for inclusion. PHP interprets included files as code, so any file with PHP syntax executes immediately.

Attack Vector

An authenticated attacker sends a crafted HTTP request to a plugin endpoint that accepts a template or file parameter. The attacker substitutes a path pointing to a sensitive file such as wp-config.php or a previously uploaded artifact. The PHP interpreter loads and executes the file. When combined with a writable upload directory, this pattern escalates to remote code execution. The CVSS attack complexity is rated High because the exploit path requires knowledge of internal file names and a valid low-privileged account.

No verified public exploit code is available for this CVE. See the Patchstack Vulnerability Report for advisory-level technical details.

Detection Methods for CVE-2025-52715

Indicators of Compromise

HTTP requests to Classified Listing plugin endpoints containing path traversal sequences such as ../ or ..%2f
Access log entries referencing sensitive files like wp-config.php, /etc/passwd, or plugin template parameters with absolute paths
Unexpected PHP errors in server logs referencing include() or require() with unusual file paths
New or modified PHP files in the WordPress uploads directory following plugin requests

Detection Strategies

Inspect web server access logs for authenticated requests to classified-listing routes carrying suspicious file or template parameters
Deploy web application firewall rules that flag path traversal patterns targeting WordPress plugin endpoints
Correlate low-privileged user sessions with subsequent file inclusion errors or webshell indicators

Monitoring Recommendations

Enable PHP error logging and forward entries to a centralized log platform for review
Alert on file integrity changes within wp-content/uploads and plugin directories
Track authentication events for subscriber and contributor accounts that precede plugin parameter tampering

How to Mitigate CVE-2025-52715

Immediate Actions Required

Update the RadiusTheme Classified Listing plugin to a version later than 4.2.0 once a fixed release is available from the vendor
Audit all WordPress accounts and remove or reset credentials for unused low-privileged users
Review the WordPress uploads directory for unauthorized PHP files and remove any that are not part of legitimate content

Patch Information

The Patchstack advisory tracks the fixed version and remediation status. Administrators should consult the Patchstack Vulnerability Report for the current patched release of the Classified Listing plugin and apply it through the WordPress plugin manager.

Workarounds

Temporarily disable the Classified Listing plugin until the patched version is installed
Restrict PHP open_basedir to the WordPress document root to limit files reachable by an inclusion attack
Enforce a web application firewall rule blocking traversal sequences and absolute paths in plugin query parameters
Set the WordPress uploads directory to disallow PHP execution using web server configuration

bash

# Apache configuration to block PHP execution in uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>

# PHP open_basedir restriction in php.ini
open_basedir = "/var/www/html:/tmp"