CVE-2025-5804: PHP Local File Inclusion in Case Theme User

The primary impact of this LFI vulnerability is the potential for remote code execution (RCE). By crafting malicious file inclusion requests, an attacker can include sensitive system files, configuration files, or even PHP scripts. Successful exploitation could allow an attacker to read sensitive data, modify application behavior, or gain complete control over the affected server. The attacker could potentially escalate privileges and move laterally within the network if the server has access to other resources. This vulnerability shares similarities with other LFI exploits where attackers leverage the ability to include arbitrary files to compromise the system.

1. Reserved2025-06-06
2. Published2026-04-10
3. Modified2026-04-28
4. EPSS updated2026-04-18

The recommended mitigation for CVE-2025-5804 is to immediately upgrade Case Theme User to version 1.0.4 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. These may include restricting file access permissions, implementing input validation to sanitize file paths, and configuring a Web Application Firewall (WAF) to block suspicious file inclusion attempts. Specifically, WAF rules should be configured to detect and block requests containing potentially malicious file paths. Monitor system logs for unusual file access patterns that might indicate exploitation attempts. After upgrading, confirm the fix by attempting a file inclusion request with a known malicious path; the request should be blocked or result in an error.