EUVD-2025-209110
GHSA-v474-g846-5m4r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Restaurant Cafeteria WordPress theme through 0.4.6 exposes insecure admin-ajax actions without nonce or capability checks, allowing any logged-in user, like subscriber, to perform privileged operations. An attacker can install and activate a from a user-supplied URL, leading to arbitrary PHP code execution, and also import demo content that rewrites site configuration, including Restaurant Cafeteria WordPress theme through 0.4.6_mods, pages, menus, and front page settings.
AnalysisAI
Restaurant Cafeteria WordPress theme through version 0.4.6 allows authenticated subscribers to execute arbitrary PHP code and modify site configuration through unprotected admin-ajax actions lacking nonce and capability checks. An attacker with subscriber-level access can install malicious plugins from attacker-controlled URLs or import demo content that overwrites critical site settings, pages, menus, and theme configuration. Publicly available exploit code exists for this vulnerability.
Technical ContextAI
The Restaurant Cafeteria WordPress theme implements AJAX endpoints that process administrative operations without implementing WordPress security mechanisms-specifically missing nonce verification (wp_verify_nonce) and capability checks (current_user_can). This allows privilege escalation from the lowest authenticated role (subscriber) to perform actions normally restricted to administrators. The vulnerability chain enables two attack paths: direct plugin installation via admin-ajax handlers that accept user-supplied plugin URLs without validation, and mass-assignment style attacks through demo content import functions that modify core WordPress options (site title, pages, menus, front page settings) and theme-specific modifications stored in wp_options. The affected component is the theme's admin-ajax.php handler implementation, which fails to enforce both authentication context validation and authorization context validation as required by WordPress security best practices.
RemediationAI
Update the Restaurant Cafeteria WordPress theme to a version newer than 0.4.6 immediately. No specific patched version number is confirmed in the provided advisory data; consult the official theme repository or vendor changelog at https://wpscan.com/vulnerability/f3f4a734-5828-4e3f-a170-28189aeda929/ for the exact minimum safe version. As a temporary workaround pending update, restrict subscriber role permissions through WordPress role management or a security plugin that blocks unauthorized admin-ajax actions; however, this does not address the underlying code defect and should not be relied upon as a permanent solution. WordPress administrators should audit user accounts to identify and remove any suspicious plugins or imported demo content that may have been deployed via this attack vector.
More from same product – last 7 days
Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to acce
Authenticated remote code execution in Discuz! X5.0 releases 20260320 through 20260501 allows administrators to chain a
Unauthenticated PHP Object Injection in the Happyforms WordPress plugin (versions <= 1.26.13) allows remote attackers to
Unauthenticated PHP Object Injection in the Broadcast Live Video WordPress plugin (versions prior to 7.1.3) allows remot
Unauthenticated PHP object injection in the WordPress plugin 'Integration for Keap/Infusionsoft and Contact Form 7, WPFo
Share
External POC / Exploit Code
Leaving vuln.today