CVE-2025-57925: immonex Kickstart Team LFI Vulnerability

CVE-2025-57925 Overview

CVE-2025-57925 is a Local File Inclusion (LFI) vulnerability in the immonex Kickstart Team WordPress plugin. The flaw stems from improper control of filenames used in PHP include or require statements [CWE-98]. It affects all plugin versions up to and including 1.6.9. An authenticated attacker with low-level privileges can manipulate file inclusion parameters to load arbitrary local PHP files on the server.

Critical Impact

Successful exploitation can lead to arbitrary PHP code execution, disclosure of sensitive configuration files, and full compromise of the WordPress site.

Affected Products

• immonex Kickstart Team WordPress plugin versions through 1.6.9
• WordPress installations with the plugin active
• Real estate websites using the immonex ecosystem on WordPress

Discovery Timeline

• 2025-09-22 - CVE-2025-57925 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-57925

Vulnerability Analysis

The vulnerability resides in PHP code paths that pass user-controllable input into include or require statements without strict validation. The plugin fails to constrain the supplied filename to a safe allowlist or base directory. An attacker can supply a crafted path value that resolves to a file outside the intended template directory.

Because PHP executes the contents of any file loaded via include, the issue extends beyond simple file disclosure. If the attacker can place or reference a .php file already present on the server, that code runs in the WordPress context. The advisory from Patchstack classifies this as PHP Local File Inclusion.

Root Cause

The root cause is a missing or insufficient input sanitization routine on a filename parameter consumed by a PHP file-loading function. The plugin trusts request-supplied values when constructing the included path. Path traversal sequences and absolute paths are not filtered, allowing the include target to escape the intended directory.

Attack Vector

The attack is delivered over the network against the WordPress site. The attacker must hold a valid low-privilege account to reach the vulnerable code path. After authentication, the attacker submits a request containing a manipulated filename parameter that the plugin passes to a PHP include directive. The server then loads and executes the referenced file.

No verified public proof-of-concept code is available. Refer to the Patchstack WordPress Vulnerability advisory for technical details.

Detection Methods for CVE-2025-57925

Indicators of Compromise

• HTTP requests to immonex Kickstart Team plugin endpoints containing path traversal sequences such as ../ or absolute paths in query parameters
• Web server access logs showing repeated requests referencing PHP filenames outside the plugin directory
• Unexpected PHP errors in WordPress logs referencing include() or require() failures on unusual file paths
• Creation or modification of .php files in wp-content/uploads followed by inclusion requests

Detection Strategies

• Inspect WordPress request logs for query string parameters that contain file paths, traversal sequences, or null bytes targeting the immonex Kickstart Team plugin
• Correlate authenticated session activity with anomalous file system access patterns on the WordPress host
• Deploy a Web Application Firewall (WAF) rule that blocks LFI patterns against the plugin's URL routes

Monitoring Recommendations

• Forward web server, PHP-FPM, and WordPress audit logs to a centralized SIEM for correlation
• Alert on PHP include or require errors that reference paths outside the WordPress document root
• Monitor for new low-privilege user registrations followed by requests to plugin endpoints

How to Mitigate CVE-2025-57925

Immediate Actions Required

• Identify all WordPress installations running the immonex Kickstart Team plugin and confirm the installed version
• Restrict access to the WordPress site for low-privilege users until patching is complete
• Review user accounts and remove any unexpected or dormant low-privilege accounts that could be abused
• Apply WAF rules that block path traversal patterns in requests to the plugin

Patch Information

The vulnerability affects immonex Kickstart Team through version 1.6.9. Site administrators should consult the Patchstack advisory and upgrade to a fixed release published by the plugin maintainer. Verify the plugin version after upgrade through the WordPress admin Plugins page.

Workarounds

• Deactivate and remove the immonex Kickstart Team plugin until a patched version is installed
• Enforce least-privilege role assignments and disable open user registration on affected sites
• Configure PHP open_basedir to restrict file inclusion to the WordPress installation directory
• Apply WAF signatures targeting ..%2f, ../, and absolute path patterns in plugin parameters

# Configuration example: restrict PHP file access via open_basedir in php.ini
open_basedir = "/var/www/html/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
allow_url_include = Off
allow_url_fopen = Off