The vulnerability arises from improper control of a filename used in a PHP include or require statement within the Case Theme User plugin. An attacker could supply a crafted path that causes the plugin to include an arbitrary local file on the server, allowing reading of sensitive files, file disclosure, or execution of PHP code if the included file contains malicious code. This weakness aligns with CWE‑98.

WordPress sites that have the Case Theme User plugin installed with a version earlier than 1.0.4 are affected. The plugin is distributed by Case Themes under the product name Case Theme User; all releases prior to 1.0.4 are impacted.

The CVSS score of 7.5 indicates a high severity local file inclusion. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Based on the updated description, the likely attack vector is remote through the web interface, such as manipulating a query parameter that is passed to the include statement. The impact is confined to the web server’s filesystem, but successful exploitation could compromise the entire site or host.