CVE-2025-32154
Published: 04 April 2025
Summary
CVE-2025-32154 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Catchthemes Catch Dark Mode. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 20.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-32154 is a PHP Local File Inclusion vulnerability arising from improper control of filenames in include/require statements. It affects the Catch Dark Mode WordPress plugin by Catch Themes, impacting all versions through 2.0.1 and carrying a CVSS 3.1 score of 7.5.
An attacker with low-privileged network access can supply crafted input to force inclusion of arbitrary local files on the server. Successful exploitation grants read access to sensitive files and can lead to full compromise of confidentiality, integrity, and availability on the affected WordPress instance.
The issue is tracked in the Patchstack vulnerability database, which identifies the affected plugin versions and provides the canonical reference for remediation details. The associated EPSS score has remained flat at 0.0122 with no observed increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9853
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Catch Themes Catch Dark Mode catch-dark-mode allows PHP Local File Inclusion.This issue affects Catch Dark Mode: from n/a through <= 2.0.1.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.