Grandprix CVE-2025-49296

CVSS 8.1 indicates high severity with multiple impact vectors (C:H, I:H, A:H), but real-world exploitability depends on several factors: (1) Attack Complexity is High (AC:H), suggesting some environmental or logical barrier exists—this may involve specific PHP configurations (allow_url_include), theme setup conditions, or payload encoding; (2) No authentication required (PR:N) significantly increases risk surface; (3) The LFI-to-RCE chain is well-established in WordPress environments, particularly if combined with log poisoning, file upload mechanisms, or session file manipulation; (4) Absence of user interaction (UI:N) means attacks are fully automatable. Without EPSS data or KEV confirmation, the AC:H rating suggests this is exploitable but not trivial. The real risk is HIGH if: (a) the theme is widely deployed, (b) POC is public, or (c) the path traversal can be chained with other WordPress features. Risk is MODERATE if exploitation requires non-default PHP settings or complex payload construction.

An unauthenticated attacker discovers a WordPress site running GrandPrix ≤1.6. The attacker identifies a vulnerable parameter in the theme's file inclusion logic (e.g., a template parameter in a custom AJAX endpoint or theme settings handler). The attacker crafts a request such as: GET /wp-content/themes/grandprix/handler.php?template=../../../../etc/passwd or similar, exploiting the path traversal to read sensitive files. If the parameter is reflected in PHP include() without sanitization, the attacker reads arbitrary files (information disclosure) and potentially accesses wp-config.php to extract database credentials. With high attack complexity, the attacker may need to: bypass URL encoding restrictions, account for PHP wrapper behavior (allow_url_include), or chain with file upload functionality to write a malicious PHP file, then include it via the traversal to achieve RCE. No POC availability was stated; if one emerges publicly, exploitation risk increases significantly due to low barrier to automation.