CVE-2025-67957: Listivo Core PHP File Inclusion Flaw

CVE-2025-67957 Overview

CVE-2025-67957 is a PHP Local File Inclusion (LFI) vulnerability affecting the Listivo Core plugin for WordPress, developed by TangibleWP. The vulnerability stems from improper control of filename parameters used in PHP include/require statements, allowing attackers to include arbitrary local files on the server. This can lead to sensitive information disclosure, execution of malicious code, or further system compromise.

Critical Impact

Attackers can exploit this Local File Inclusion vulnerability to read sensitive files from the server, potentially including configuration files with database credentials, or chain with other vulnerabilities for remote code execution.

Affected Products

• TangibleWP Listivo Core plugin versions through 2.3.77
• WordPress installations using the vulnerable Listivo Core plugin
• Websites built on the Listivo theme ecosystem

Discovery Timeline

• 2026-01-22 - CVE-2025-67957 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2025-67957

Vulnerability Analysis

This vulnerability is classified as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program. The Listivo Core plugin fails to properly validate or sanitize user-supplied input before using it in PHP file inclusion operations. When an attacker can control or influence the filename parameter passed to include(), require(), include_once(), or require_once() functions, they can potentially include arbitrary files from the local filesystem.

Local File Inclusion attacks can be particularly dangerous in WordPress environments as they may allow attackers to read the wp-config.php file containing database credentials, access log files that may contain sensitive session data, or include files that can be manipulated to execute arbitrary PHP code.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the Listivo Core plugin's file handling logic. The plugin accepts user-controlled input and passes it directly or with inadequate sanitization to PHP file inclusion functions. This allows attackers to manipulate file paths using techniques such as directory traversal sequences (../) or null byte injection (in older PHP versions) to access files outside the intended directory scope.

Proper implementation should include strict allowlist validation of filenames, removal of path traversal sequences, and verification that resolved paths remain within expected directories.

Attack Vector

The attack vector involves crafting malicious requests that include manipulated file path parameters. An attacker targeting this vulnerability would typically:

1. Identify input parameters that influence file inclusion operations in the Listivo Core plugin
2. Craft malicious payloads containing directory traversal sequences to escape the intended directory
3. Target sensitive files such as /etc/passwd, wp-config.php, or log files
4. Potentially chain the LFI with log poisoning or other techniques to achieve code execution

The vulnerability can be exploited remotely through specially crafted HTTP requests to the affected WordPress installation, requiring no authentication in many LFI scenarios.

For detailed technical information about this vulnerability, refer to the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2025-67957

Indicators of Compromise

• HTTP requests containing directory traversal sequences (../, ..%2f, %2e%2e/) targeting Listivo Core endpoints
• Access attempts to sensitive files like wp-config.php, /etc/passwd, or log files through the plugin
• Unusual file access patterns in web server logs involving the listivo-core plugin directory
• Error messages indicating failed file inclusion attempts or path traversal attempts

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block path traversal patterns in request parameters
• Configure intrusion detection systems to alert on LFI attack signatures targeting WordPress plugins
• Implement log analysis rules to identify requests with suspicious file path patterns
• Use WordPress security plugins that monitor for file inclusion attack attempts

Monitoring Recommendations

• Enable detailed logging for the WordPress installation and monitor for anomalous file access patterns
• Set up alerts for access attempts to sensitive system files through web server logs
• Monitor application error logs for PHP warnings related to file inclusion failures
• Regularly review web server access logs for requests containing encoded traversal sequences

How to Mitigate CVE-2025-67957

Immediate Actions Required

• Update the Listivo Core plugin to a version newer than 2.3.77 that addresses this vulnerability
• If an update is not immediately available, consider temporarily deactivating the Listivo Core plugin
• Implement WAF rules to block path traversal attempts targeting the WordPress installation
• Review server logs for any indicators of exploitation attempts

Patch Information

The vulnerability affects Listivo Core plugin versions through 2.3.77. Website administrators should check the WordPress plugin repository or the TangibleWP vendor website for security updates that address this Local File Inclusion vulnerability. Monitor the Patchstack advisory for updated patch information.

Workarounds

• Implement server-level restrictions to limit PHP file inclusion to specific directories using open_basedir configuration
• Deploy a Web Application Firewall with rules specifically designed to block LFI attack patterns
• Restrict access to sensitive directories and files using proper file system permissions
• Consider using WordPress security plugins that provide real-time protection against file inclusion attacks

# PHP configuration hardening for open_basedir restriction
# Add to php.ini or Apache/Nginx configuration
open_basedir = /var/www/html/wordpress:/tmp

# Apache .htaccess rule to block common LFI patterns
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./|\.\.%2f|%2e%2e/) [NC,OR]
RewriteCond %{QUERY_STRING} (etc/passwd|proc/self) [NC]
RewriteRule .* - [F,L]
</IfModule>