Executive Summary

CVE-2025-5804 is a Local File Inclusion (LFI) vulnerability in the WordPress Case Theme User plugin versions prior to 1.0.4. It allows an attacker to include and display local files from the target website by exploiting improper control of filenames in PHP include/require statements.

This vulnerability is classified as high priority with a CVSS score of 7.5 and falls under the OWASP Top 10 category A3: Injection.

Exploitation can be triggered by an unauthenticated user but requires a privileged user to perform an action such as clicking a malicious link, visiting a crafted page, or submitting a form.

Useful 0 Not Useful 0

Impact Analysis

Successful exploitation of this vulnerability can lead to the attacker including and viewing sensitive local files on the website, such as database credentials.

Depending on the website's configuration, this could result in a complete database takeover.

The vulnerability is highly dangerous and expected to be exploited in mass campaigns targeting many websites regardless of their traffic or popularity.

Useful 0 Not Useful 0

Compliance Impact

The CVE-2025-5804 vulnerability allows attackers to include and display local files from the target website, potentially exposing sensitive information such as database credentials.

Exposure of sensitive data through this Local File Inclusion vulnerability could lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information.

Therefore, if exploited, this vulnerability may compromise compliance with these common standards and regulations by enabling unauthorized access to protected data.

Useful 0 Not Useful 0

Detection Guidance

The CVE-2025-5804 vulnerability is a Local File Inclusion (LFI) issue affecting the WordPress Case Theme User Plugin versions prior to 1.0.4. Detection involves monitoring for attempts to include local files via crafted URLs or form submissions targeting the plugin.

Since exploitation can be triggered by visiting a malicious link or submitting a crafted form, network detection can focus on identifying suspicious HTTP requests containing file inclusion patterns or unusual parameters related to the plugin.

Specific commands are not provided in the resources, but common approaches include searching web server logs for suspicious requests or using intrusion detection systems (IDS) with rules to detect LFI attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the Case Theme User plugin to version 1.0.4 or later, which contains the patch resolving this Local File Inclusion vulnerability.

Until the update can be applied, Patchstack provides a mitigation rule to block attacks exploiting this vulnerability.

Users unable to update immediately are advised to seek assistance from their hosting provider or web developer to apply temporary protections.

Useful 0 Not Useful 0