The Catch Dark Mode WordPress plugin contains a Local File Inclusion vulnerability that allows authenticated users with Contributor-level access to include and execute arbitrary .php files on the server. This flaw is triggered via the catch_dark_mode shortcode and permits the execution of any PHP code contained in the chosen file, enabling attackers to bypass access controls, retrieve sensitive data, or run arbitrary code on the host. The likely attack vector involves supplying a malicious file path via the shortcode, a detail that is inferred from the description.

The vulnerability affects the Catch Dark Mode plugin from Catch Themes. All releases up to and including version 2.0 are impacted. Users of older versions must update to a later release to eliminate the flaw.

The likely attack vector involves supplying a malicious file path through the catch_dark_mode shortcode, which is inferred from the description. The CVSS score of 7.5 indicates a high severity local vulnerability. The EPSS score of less than 1% reflects a low likelihood of exploitation at present, and the issue is not listed in the CISA KEV catalog. Attackers require authenticated Contributor or higher privileges and must supply a malicious path via the catch_dark_mode shortcode, often by first uploading a .php file or referencing an existing one on the server.