A critical local file inclusion vulnerability in the Case Theme User WordPress plugin allows unauthenticated attackers to execute arbitrary files, posing a severe risk of system compromise.

This vulnerability is a local file inclusion flaw (CWE-98) stemming from improper control of filenames used in include statements. It allows an unauthenticated attacker to manipulate file paths to include local files, potentially leading to unauthorized data access or code execution.

Successful exploitation of this vulnerability enables attackers to read sensitive configuration files or execute arbitrary code on the underlying server. Given the CVSS score of 7.5, this high-severity flaw threatens the confidentiality, integrity, and availability of the entire WordPress installation. Organizations failing to remediate this issue face significant risks of data exfiltration and complete system takeover.

Immediate Action: Update the Case Theme User plugin to version 1.0.4 or higher immediately to apply the vendor-supplied security patch.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal patterns or unexpected file path inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious file inclusion attempts and directory traversal strings.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates prompt action. Administrators should verify their current version of the Case Theme User plugin and apply the update to version 1.0.4 without delay. If an update is not immediately feasible, consider disabling the plugin until a secure version can be deployed to prevent potential unauthorized access.