CVE-2025-32154: Catch Dark Mode Path Traversal Flaw

CVE-2025-32154 Overview

CVE-2025-32154 is a Local File Inclusion (LFI) vulnerability in the Catch Themes Catch Dark Mode WordPress plugin. The flaw exists in versions up to and including 2.0.1 and stems from improper control of filenames in PHP include/require statements [CWE-98]. Authenticated attackers can manipulate file path parameters to load arbitrary PHP files from the server. Successful exploitation leads to code execution within the WordPress context, exposure of sensitive configuration files, and full site compromise. The vulnerability is tracked by Patchstack and carries a network attack vector with low privilege requirements.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, leading to remote code execution and full compromise of WordPress sites running Catch Dark Mode ≤ 2.0.1.

Affected Products

Catch Themes Catch Dark Mode WordPress plugin — all versions through 2.0.1
WordPress sites with the catch-dark-mode plugin installed and activated
Hosting environments running PHP that serve the affected plugin

Discovery Timeline

2025-04-04 - CVE-2025-32154 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32154

Vulnerability Analysis

The vulnerability is classified as Improper Control of Filename for Include/Require Statement in PHP Program [CWE-98]. Attacker-controlled input reaches a PHP include or require call inside the Catch Dark Mode plugin without proper sanitization or allow-list validation. As a result, an authenticated user with at least low-privilege access on the WordPress instance can coerce the plugin into loading arbitrary files from the local filesystem. When the included file contains PHP, the server executes it under the web server account. This expands the impact from information disclosure to remote code execution on the underlying host.

Root Cause

The plugin builds a file path from request data and passes it directly to a PHP file-inclusion sink. Missing checks include path normalization, directory restriction, and extension validation. Because PHP executes any included file with a PHP interpreter, an attacker who can place or reach a .php file on disk — including log files, uploaded media, or session files — can trigger arbitrary code execution. The EPSS score for this CVE is 1.22%, ranking in the 79th percentile of exploitation likelihood.

Attack Vector

The attack requires network access to the WordPress site and a valid low-privileged account such as Subscriber or Contributor. The attacker sends a crafted HTTP request to a plugin endpoint that resolves an attacker-controlled parameter to a filesystem path. The vulnerability does not require user interaction. See the Patchstack WordPress Plugin Vulnerability advisory for additional context on the affected sinks.

No public proof-of-concept exploit is currently listed in Exploit-DB or vendor advisories. Refer to the Patchstack advisory for technical details on the vulnerable parameter and patched code paths.

Detection Methods for CVE-2025-32154

Indicators of Compromise

HTTP requests to Catch Dark Mode plugin endpoints containing directory traversal sequences such as ../ or absolute filesystem paths.
Web server access logs showing requests with file path parameters referencing wp-config.php, /etc/passwd, /proc/self/environ, or PHP session files.
Unexpected outbound network connections from the PHP-FPM or web server process after requests to the plugin.
New or modified PHP files in the WordPress uploads directory or plugin directories.

Detection Strategies

Inspect web access logs for parameters carrying file paths or null-byte sequences directed at wp-content/plugins/catch-dark-mode/ URIs.
Deploy a Web Application Firewall (WAF) rule that blocks path traversal patterns and absolute path references in plugin request parameters.
Monitor PHP error logs for failed to open stream and include() warnings referencing unexpected paths.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress installation, focusing on wp-content/plugins/ and wp-content/uploads/.
Correlate authentication events with subsequent plugin endpoint access to detect low-privilege accounts pivoting to LFI exploitation.
Alert on PHP process execution chains that spawn shells (sh, bash, cmd.exe) or networking utilities (curl, wget, nc).

How to Mitigate CVE-2025-32154

Immediate Actions Required

Update Catch Dark Mode to a version newer than 2.0.1 once the vendor publishes a patched release.
Deactivate and remove the plugin if a patched version is not yet available and the dark mode feature is non-essential.
Audit all WordPress user accounts and revoke unnecessary low-privilege access to reduce the authenticated attack surface.
Rotate WordPress secret keys, database credentials, and API tokens stored in wp-config.php if exploitation is suspected.

Patch Information

Consult the Patchstack advisory for Catch Dark Mode for the current fixed version and upgrade guidance. Apply the vendor update through the WordPress plugin manager or by replacing the plugin directory with the patched release.

Workarounds

Restrict access to WordPress administrative and plugin endpoints using IP allow-lists at the reverse proxy or WAF layer.
Configure PHP open_basedir to limit which directories the web server process can read, reducing the impact of arbitrary file inclusion.
Disable allow_url_include in php.ini to prevent remote file inclusion variants.
Apply a virtual patch via a WAF that blocks traversal sequences and unexpected file extensions in plugin request parameters.

bash

# Configuration example: harden PHP against file inclusion attacks
# /etc/php/8.x/fpm/php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Restart PHP-FPM to apply
sudo systemctl restart php-fpm