The vulnerability CVE-2025-32298 in Case-Themes CTUsers arises from improper validation or control of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), potentially enabling access to sensitive files or execution of arbitrary code within the context of the web server. The affected versions include all releases up to and including 1.0.0. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized modification of data, and disruption of service on the affected system. The high CVSS score indicates significant risk if exploited. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable components and applying best practices for PHP security to mitigate potential exploitation. Monitor vendor channels for updates and patches.