Skip to main content

PHP CVE-2025-5804

| EUVD-2025-209401 HIGH
PHP Remote File Inclusion (CWE-98)
2026-04-10 Patchstack
PHP Information Disclosure LFI
7.5
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Re-analysis Queued
Apr 23, 2026 - 15:43 vuln.today
cvss_changed
Analysis Updated
Apr 16, 2026 - 05:58 EUVD-patch-fix
executive_summary
Re-analysis Queued
Apr 16, 2026 - 05:29 backfill_euvd_patch
patch_released
Patch available
Apr 16, 2026 - 05:29 EUVD
1.0.4
EUVD ID Assigned
Apr 10, 2026 - 13:45 euvd
EUVD-2025-209401
Analysis Generated
Apr 10, 2026 - 13:45 vuln.today
CVE Published
Apr 10, 2026 - 13:19 nvd
HIGH 7.5

DescriptionNVD

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Case Themes Case Theme User allows PHP Local File Inclusion.This issue affects Case Theme User: from n/a before 1.0.4.

AnalysisAI

Local file inclusion in Case Themes Case Theme User WordPress plugin (versions prior to 1.0.4) enables unauthenticated remote attackers to include arbitrary local files via PHP require/include statements. Successful exploitation requires high attack complexity and user interaction, but grants full compromise of confidentiality, integrity, and availability. Attackers may read sensitive configuration files, execute malicious code if file upload exists, or escalate to remote code execution through log poisoning techniques. No public exploit identified at time of analysis.

Technical ContextAI

CWE-98 PHP file inclusion flaw stems from improper sanitization of file paths in require/include statements. The CVSS vector indicates network-accessible attack surface (AV:N) requiring user interaction (UI:R) and high complexity (AC:H), suggesting exploitation depends on specific conditions like user-triggered actions or race conditions. CPE identifies Case Themes Case Theme User WordPress plugin as affected component.

RemediationAI

Vendor-released patch: upgrade Case Theme User plugin to version 1.0.4 or later, which remediates the PHP file inclusion vulnerability. Administrators should update immediately through WordPress plugin management interface or manual installation. If immediate patching is not feasible, deactivate and remove Case Theme User plugin until upgrade is completed. Implement web application firewall rules to block directory traversal patterns (../, %2e%2e/) and null byte injection attempts targeting plugin endpoints. Review server logs for suspicious file access patterns indicating exploitation attempts. Full technical details available at Patchstack advisory: https://patchstack.com/database/wordpress/plugin/case-theme-user/vulnerability/wordpress-case-theme-user-1-0-4-local-file-inclusion-vulnerability?_s_id=cve

Share

CVE-2025-5804 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy