PT-2025-38097 · WordPress · Catch Dark Mode

Djaidja Moundjid + 1 · Published 2025-09-17 · Updated 2025-09-17 · CVE-2025-10143

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Catch Dark Mode plugin for WordPress versions up to and including 2.0

Description The Catch Dark Mode plugin for WordPress is susceptible to a Local File Inclusion issue via the catch dark mode shortcode. This allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary .php files on the server. Successful exploitation can lead to bypassing access controls, obtaining sensitive data, or achieving code execution if .php file uploads are permitted.

Recommendations Versions prior to 2.1 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-10143

Affected Products

Catch Dark Mode

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-10143 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/46776cd5-5262-46ea-b56c-0cbf2b9ae43d?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3359058 · Note
• https://t.me/CVEtracker/32704 · Telegram Post
• https://t.me/cveNotify/135611 · Telegram Post
• https://wordpress.org/plugins/catch-dark-mode · Note
• https://plugins.trac.wordpress.org/browser/catch-dark-mode/trunk/plugin.php#L483 · Note
• https://twitter.com/CVEnew/status/1968190752724283470 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1968180752366915585 · Twitter Post