CVE-2025-5804

High

Published: 10 April 2026

Published

10 April 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0003 7.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-5804 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 7.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-5804 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the Case Theme User WordPress plugin by Case Themes. The issue affects all versions of the plugin from n/a through those prior to 1.0.4.

An unauthenticated remote attacker can exploit this vulnerability over the network with high attack complexity and required user interaction, such as tricking a site visitor into performing a specific action. Successful exploitation grants high impacts on confidentiality, integrity, and availability, as scored at CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), potentially allowing the attacker to include and execute local PHP files.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/case-theme-user/vulnerability/wordpress-case-theme-user-1-0-4-local-file-inclusion-vulnerability?_s_id=cve details the local file inclusion vulnerability and indicates it is addressed in version 1.0.4 of the Case Theme User plugin. Mitigation involves updating affected WordPress installations to version 1.0.4 or later.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-209401

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Case Themes Case Theme User case-theme-user allows PHP Local File Inclusion.This issue affects Case Theme User: from n/a through < 1.0.4.

CWE(s): CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

LFI vuln in public-facing WordPress plugin directly enables remote exploitation (T1190) and web shell/code execution via PHP file inclusion (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1