CVE-2025-5804

Name of the Vulnerable Software and Affected Versions Case Theme User versions prior to 1.0.4

Description The Case Theme User plugin for WordPress contains a Local File Inclusion flaw. This occurs when the application improperly controls filenames used in PHP include or require statements. Unauthenticated attackers can exploit this to include and execute arbitrary files on the server, potentially leading to the execution of PHP code, bypassing access controls, or obtaining sensitive data, especially if images or other safe file types can be uploaded and subsequently included.

Recommendations Update Case Theme User to version 1.0.4 or later.