PHP Local File Inclusion Vulnerability in Case Themes Case Theme User Plugin
CVE-2025-5804

7.5HIGH

Key Information:

Vendor

WordPress
Status
Case Theme User
Vendor
CVE Published:
10 April 2026

What is CVE-2025-5804?

A vulnerability has been identified in the Case Themes Case Theme User plugin that allows for improper control of filenames utilized in PHP include or require statements. This flaw can enable potential attackers to execute unauthorized PHP code on the server via Local File Inclusion (LFI). The issue specifically affects versions of the Case Theme User plugin prior to 1.0.4, making it critical for users to update their plugin to mitigate security risks associated with this vulnerability.

Affected Version(s)

Case Theme User < 1.0.4

References

https://patchstack.com/database/wordpress/plugin/case-the...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bonds | Patchstack Bug Bounty Program
.