Case-Themes vulnerabilities

Products

• Booked 1
• Case Addons 1
• Case Theme User 1
• CTUsers 1

Latest Case-Themes CVEs

Newest publication first

1. CVE-2026-22341 WordPress Booked plugin <= 3.0.0 - Account Takeover vulnerability

   Published 2026-02-20

   Medium·CVSS 6.7 EPSS 0.41%

   Authentication Bypass Using an Alternate Path or Channel vulnerability in Case-Themes Booked booked allows Authentication Abuse.This issue affects Booked: from n/a through <= 3.0.0.

2. CVE-2025-62047 WordPress Case Addons plugin < 1.3.0 - Arbitrary File Upload vulnerability

   Published 2025-11-06

   Critical·CVSS 9.9 EPSS 0.45%

   Unrestricted Upload of File with Dangerous Type vulnerability in Case-Themes Case Addons case-addons.This issue affects Case Addons: from n/a through < 1.3.0.

3. CVE-2025-5821 Case Theme User <= 1.0.3 - Authentication Bypass via Social Login

   Published 2025-08-23

   Critical·CVSS 9.8 EPSS 0.76%

   The Case Theme User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.3. This is due to the plugin not properly logging in a user with the data that was previously verified through the facebook_ajax_login_callback() function. Th...

4. CVE-2025-32298 WordPress CTUsers plugin <= 1.0.0 - Local File Inclusion Vulnerability

   Published 2025-06-27

   High·CVSS 7.5 EPSS 0.62%

   Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Case-Themes CTUsers ctuser allows PHP Local File Inclusion.This issue affects CTUsers: from n/a through <= 1.0.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.