CVE-2025-67957
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | listivo_core | to 2.3.77 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-67957 is a Local File Inclusion (LFI) vulnerability in the WordPress Listivo Core Plugin versions up to 2.3.77. It allows an unauthenticated attacker to include and display local files from the target website by exploiting improper control of filenames in include/require statements. This can expose sensitive information such as database credentials and potentially lead to a complete database takeover depending on the website's configuration. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to access and display sensitive local files on your website without authentication. This exposure can lead to disclosure of critical information like database credentials and may result in a complete database takeover, compromising the security and integrity of your website and data. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability can negatively affect compliance with standards such as GDPR and HIPAA because it may lead to unauthorized disclosure of sensitive personal or protected health information stored on the affected system. Such data breaches can result in violations of data protection regulations, leading to legal and financial consequences. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this Local File Inclusion (LFI) vulnerability can be done by monitoring for attempts to include local files via the vulnerable WordPress Listivo Core Plugin (versions ≤ 2.3.77). One can look for suspicious HTTP requests targeting the plugin that attempt to include local files, such as requests containing parameters with file paths (e.g., ../../etc/passwd). Network or web server logs can be searched for such patterns. Specific commands might include using grep on web server logs to find suspicious inclusion attempts, for example: grep -i 'listivo-core' /var/log/apache2/access.log | grep -E '(\.|%2e){2,}/' or using intrusion detection systems with rules targeting this vulnerability. Patchstack provides mitigation rules that can help detect and block attacks targeting this vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the WordPress Listivo Core Plugin to version 2.3.78 or later, where the vulnerability is fixed. Until the update can be applied, users of Patchstack can enable mitigation rules provided by Patchstack to block attacks targeting this vulnerability. Additionally, enabling auto-updates for vulnerable plugins can ensure rapid protection against exploitation. [1]