Vulnerabilities

TI-2025-05234 CVE-2025-5804 · GHSA-wvjf-23gc-c2fw

WordPress Case Theme User < 1.0.4 - Local File Inclusion Vulnerability

LOW 35

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Case Themes Case Theme User case-theme-user allows PHP Local File Inclusion.This issue affects Case…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00509 Published 2026-04-10 No fix listed CWE-98

TI-2026-17923 CVE-2026-22341 · GHSA-j368-q2mr-vhv4

WordPress Booked plugin <= 3.0.0 - Account Takeover vulnerability

LOW 30

Authentication Bypass Using an Alternate Path or Channel vulnerability in Case-Themes Booked booked allows Authentication Abuse.This issue affects Booked: from n/a through <= 3.0.0.

CVSS 3.1MEDIUM 6.7 Network High privileges No interaction EPSS 0.00411 Published 2026-02-20 No fix listed CWE-288

TI-2025-38370 CVE-2025-62047 · GHSA-cm3p-rq24-84m2

WordPress Case Addons plugin < 1.3.0 - Arbitrary File Upload vulnerability

MEDIUM 43

Unrestricted Upload of File with Dangerous Type vulnerability in Case-Themes Case Addons case-addons.This issue affects Case Addons: from n/a through < 1.3.0.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00448 Published 2025-11-06 No fix listed CWE-434

TI-2025-05249 CVE-2025-5821 · GHSA-8v37-q45v-wgrx

Case Theme User <= 1.0.3 - Authentication Bypass via Social Login

MEDIUM 50

The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00761 Published 2025-08-23 No fix listed CWE-288

TI-2025-23395 CVE-2025-32298 · GHSA-64qg-f3v5-rrq5

WordPress CTUsers plugin <= 1.0.0 - Local File Inclusion Vulnerability

LOW 36

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Case-Themes CTUsers ctuser allows PHP Local File Inclusion.This issue affects CTUsers: from n/a thr…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00619 Published 2025-06-27 No fix listed CWE-98