What the vulnerability does
01Description
The Catch Dark Mode plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0 via the 'catch_dark_mode' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Explanation of Vulnerability in Simple Terms
02Summary
Catch Dark Mode versions 2.0 and earlier contain a vulnerability allowing authenticated users with low privileges to read sensitive data, modify site content, or disrupt service. The vulnerability requires network access and high attack complexity. No public exploit is currently known. Site administrators should update to a version newer than 2.0 when available.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify site content, or disrupt service availability.
Potential impact on your site
04Site Impact
A logged-in user with basic permissions could compromise site data, content integrity, or availability.
Conditions required to exploit
05Prerequisites
Attacker must have low-level authenticated access to the site.
Key dates
06Disclosure timeline
September 17, 2025
CVE published
April 8, 2026
Record updated
