Local File Inclusion Vulnerability in NTM Custom Field List Widget by WordPress

CVE-2025-23952

What is CVE-2025-23952?

The NTM Custom Field List Widget for WordPress features a vulnerability that allows for Local File Inclusion due to improper control of filename inputs in PHP scripts. This weakness can expose sensitive files or content on the server, allowing an attacker to potentially execute arbitrary code or gain access to critical system information. It affects versions starting from n/a up to 1.5.1, necessitating prompt updates and remediation.

References