CVE-2025-10143
📋 TL;DR
The Catch Dark Mode WordPress plugin contains a Local File Inclusion vulnerability that allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary PHP files on the server. This can lead to remote code execution, data theft, or privilege escalation. All WordPress sites using this plugin up to version 2.0 are affected.
💻 Affected Systems
- Catch Dark Mode WordPress Plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise via remote code execution, data exfiltration, and complete site takeover.
Likely Case
Unauthorized file access, privilege escalation to administrator, and installation of backdoors.
If Mitigated
Limited impact if proper file upload restrictions and server hardening are in place.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.1
Vendor Advisory: https://wordpress.org/plugins/catch-dark-mode/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Catch Dark Mode and click 'Update Now'. 4. Verify version is 2.0.1 or higher.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate catch-dark-mode
Restrict User Roles
allRemove Contributor and higher roles from untrusted users.
🧯 If You Can't Patch
- Implement strict file upload restrictions to prevent PHP file uploads
- Add web application firewall rules to block local file inclusion attempts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Catch Dark Mode version 2.0 or lower.Check Version:
wp plugin get catch-dark-mode --field=versionVerify Fix Applied:
Confirm plugin version is 2.0.1 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual file include requests in web server logs
- PHP error logs showing file inclusion failures
- WordPress audit logs showing plugin file access by Contributor users
Network Indicators:
- HTTP requests with catch_dark_mode shortcode parameters pointing to local files
SIEM Query:
source="web_server" AND (uri="*catch_dark_mode*" AND (param="*php" OR param="*../*"))