CVE-2025-67955: 
WordPress vulnerability analysis and mitigation

CVE-2025-67955 is a Local File Inclusion (LFI) vulnerability in the TangibleWP MyHome Core WordPress plugin, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the MyHome Core plugin up to and including 4.1.0, and was reported by researcher João Pedro S Alcântara (Kinorth) on November 8, 2025, with public disclosure on January 21–22, 2026. The vulnerability was assigned a CVSS v3.1 base score of 7.5 (High) by Patchstack, with a revised vector reflecting network-based exploitation requiring low complexity and authenticated access (Patchstack, NVD).

The root cause is improper sanitization of user-supplied input used in PHP include/require statements, classified as CWE-98 (PHP Remote File Inclusion, which also encompasses Local File Inclusion). An attacker can manipulate a filename parameter to traverse the server's file system and include arbitrary local files, causing their contents to be read and potentially rendered. This attack vector is network-based, requires no user interaction, and — per the updated Patchstack CVSS vector — requires low privileges and high attack complexity. Sensitive files such as WordPress configuration files (e.g., wp-config.php) containing database credentials are prime targets (Patchstack, NVD).

Successful exploitation allows an attacker to read arbitrary local files on the web server, including sensitive configuration files such as wp-config.php that contain database credentials, potentially enabling complete database takeover. The confidentiality impact is rated High, as credentials and other sensitive data can be exposed. While integrity and availability are not directly impacted by the LFI itself, exposed database credentials could facilitate further compromise, lateral movement, or full site takeover (Patchstack).

No public proof-of-concept exploit code has been identified at this time, and there is no confirmed evidence of active in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.053% (0.000530), indicating a low current probability of exploitation in the wild. Patchstack has noted that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress plugins regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the MyHome Core plugin (version ≤ 4.1.0) using tools like WPScan, Shodan, or by inspecting plugin directories exposed via the target site.
2. Identify vulnerable parameter: Locate the plugin's PHP code path that passes user-controlled input to an include or require statement without adequate sanitization.
3. Craft LFI payload: Construct a request with a path traversal payload (e.g., ../../../../wp-config.php) in the vulnerable parameter to reference a sensitive local file.
4. Send malicious request: Submit the crafted HTTP request to the vulnerable endpoint on the target WordPress site, potentially requiring a low-privilege authenticated session per the updated CVSS vector.
5. Retrieve sensitive data: If successful, the server returns the contents of the included file (e.g., database credentials from wp-config.php), which can then be used for further attacks such as database access or privilege escalation (Patchstack).

• Network: Unusual HTTP requests to MyHome Core plugin endpoints containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body.
• Logs: WordPress or web server access logs showing requests with encoded traversal strings targeting plugin-specific PHP files; HTTP 200 responses to requests containing file path patterns like wp-config.php.
• File System: No direct file system artifacts from LFI alone, but monitor for unexpected file reads of sensitive files (e.g., wp-config.php, /etc/passwd) in server audit logs if file access auditing is enabled.
• Process: Unexpected database connection attempts from new or external IP addresses following a potential credential exposure event.

The vulnerability is patched in MyHome Core version 4.1.1; all users should update immediately from the WordPress plugin repository. If an immediate update is not possible, site administrators should consult their hosting provider or web developer for assistance. Patchstack users benefit from a virtual patching/mitigation rule that blocks exploitation attempts until the plugin is updated (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for January 19–25, 2026, highlighting it as part of broader plugin security coverage (Wordfence). No significant independent researcher commentary or major media coverage beyond standard vulnerability database reporting has been identified.