CVE-2025-23937

WordPress LinkedIn Lite Plugin <= 1.0 - Local File Inclusion vulnerability

Published Mar 26, 2025 CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alex Furr LinkedIn Lite linkedin-lite allows PHP Local File Inclusion.This issue affects LinkedIn Lite: from n/a through <= 1.0.

Analysis

Technical impact

An improper control of the filename used in a PHP include/require statement allows local file inclusion within the LinkedIn Lite WordPress plugin. The flaw can enable an attacker to read sensitive files on the server or execute code that resides on the file system, leading to data exposure or full server compromise. This vulnerability is catalogued as CWE-98, highlighting the weakness in unrestricted file inclusion.

Affected Systems

The issue impacts the LinkedIn Lite plugin for WordPress authored by Alex Furr, affecting all versions from the initial release through and including version 1.0. Any WordPress site that has this plugin installed and running these affected versions is susceptible.

Risk and Exploitability

With a CVSS score of 8.1 the flaw presents a high severity level. The EPSS score is listed as less than 1 %, indicating a low probability of exploitation at this time, and it is not currently included in the CISA KEV catalog. The attacker’s ability to exploit this vulnerability would typically require access to the WordPress installation, either by remote means that can trigger the include path or via an existing local vulnerability that grants file write or read capabilities. Given these conditions, the risk remains moderate to high for installations running the affected plugin.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Alex Furr

LinkedIn Lite

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.0

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade LinkedIn Lite to the latest available version, which removes the insecure include handling.
If upgrading is not immediately possible, remove the LinkedIn Lite plugin from the WordPress site until a fix is available.
Restrict file system permissions on the WordPress directory so that PHP cannot read or execute arbitrary files outside the intended scope.

Generated by OpenCVE AI on May 1, 2026 at 13:26 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-8183	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NotFound LinkedIn Lite allows PHP Local File Inclusion. This issue affects LinkedIn Lite: from n/a through 1.0.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.1% (1.062% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/linkedin-lite/vulnerability/wordpress-linkedin-lite-plugin-1-0-local-file-inclusion-vulnerability?_s_id=cve

History

Apr 23, 2026 3:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Apr 1, 2026 11:45 PM Description updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NotFound LinkedIn Lite allows PHP Local File Inclusion. This issue affects LinkedIn Lite: from n/a through 1.0.	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alex Furr LinkedIn Lite linkedin-lite allows PHP Local File Inclusion.This issue affects LinkedIn Lite: from n/a through <= 1.0.
References	https://patchstack.com/database/wordpress/plugin/linkedin-lite/vulnerability/wordpress-linkedin-lite-plugin-1-0-local-file-inclusion-vulnerability?_s_id=cve	https://patchstack.com/database/Wordpress/Plugin/linkedin-lite/vulnerability/wordpress-linkedin-lite-plugin-1-0-local-file-inclusion-vulnerability?_s_id=cve
Metrics	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Mar 26, 2025 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mar 26, 2025 2:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NotFound LinkedIn Lite allows PHP Local File Inclusion. This issue affects LinkedIn Lite: from n/a through 1.0.
Title		WordPress LinkedIn Lite Plugin <= 1.0 - Local File Inclusion vulnerability
Weaknesses		CWE-98
References		https://patchstack.com/database/wordpress/plugin/linkedin-lite/vulnerability/wordpress-linkedin-lite-plugin-1-0-local-file-inclusion-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`