The vulnerability CVE-2025-23952 affects the ntm custom-field-list-widget plugin up to version 1.5.1. It involves improper control of the filename parameter in PHP include or require statements, leading to a Local File Inclusion (LFI) vulnerability. This allows an attacker to include and execute arbitrary files on the server, potentially leading to full system compromise. The CVSS 3.1 base score is 8.1, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the vulnerability is not related to a cloud service.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data and disruption of service. The attacker can execute arbitrary code by including local files via the vulnerable PHP include/require statement. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version 1.5.1 or earlier. Monitor vendor channels for updates and apply patches promptly once available.