CVE-2025-5804

CVE-2025-5804 is a PHP Local File Inclusion vulnerability in the Case Theme User component versions prior to 1.0.4, stemming from improper control of filenames in PHP include/require statements. This flaw allows attackers to manipulate file paths and potentially execute arbitrary code or access sensitive information through remote file inclusion attacks. The vulnerability carries a HIGH severity rating with a CVSS score of 7.5, featuring a network attack vector with high complexity and no privilege or user interaction required beyond user action. The attack could result in high-impact consequences across confidentiality, integrity, and availability of affected systems. Currently, CVE-2025-5804 shows minimal exploitation activity with an EPSS score of 0.00024, indicating it ranks higher than only 0.066% of all CVEs in exploitation likelihood. There is no indication of active in-the-wild exploitation, public exploit code availability, or significant community attention at this time, though the moderate FAUCET Risk Score of 48.0 suggests organizations should monitor for developments and apply available patches promptly.