Local File Inclusion Vulnerability in Catch Dark Mode Plugin for WordPress

CVE-2025-10143

What is CVE-2025-10143?

The Catch Dark Mode plugin for WordPress is susceptible to Local File Inclusion through the 'catch_dark_mode' shortcode, affecting all versions up to and including 2.0. This vulnerability allows authenticated attackers with Contributor-level access and above to include and execute arbitrary PHP files from the server. Exploiting this flaw could enable attackers to bypass access controls, access sensitive data, or execute malicious PHP code, posing significant security risks for affected WordPress installations.

References