EUVD-2025-17550CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Path Traversal vulnerability in Mikado-Themes GrandPrix allows PHP Local File Inclusion. This issue affects GrandPrix: from n/a through 1.6.
Analysis
A Path Traversal vulnerability in Mikado-Themes GrandPrix WordPress theme (versions through 1.6) allows unauthenticated remote attackers to perform PHP Local File Inclusion (LFI) attacks, potentially leading to arbitrary file reading, information disclosure, and remote code execution. The vulnerability has a CVSS score of 8.1 (High) with high impact on confidentiality, integrity, and availability; exploitation requires medium attack complexity but no user interaction or privileges. KEV status and active exploitation data were not provided, but the high CVSS and LFI nature suggest significant real-world risk if POC is publicly available.
Technical Context
This vulnerability exploits improper input validation in the GrandPrix WordPress theme's file handling logic, falling under CWE-35 (Path Traversal). The weakness allows attackers to manipulate file path parameters (likely via GET/POST parameters or URL manipulation) to traverse directory structures using sequences such as '../' or null bytes, enabling inclusion of arbitrary files outside the intended directory. In WordPress theme contexts, this typically affects template inclusion mechanisms, file loading functions, or custom AJAX handlers that fail to properly sanitize user-supplied paths before passing them to PHP functions like include(), require(), file_get_contents(), or similar. The vulnerability is network-accessible (AV:N) and affects PHP execution environments running WordPress with this theme active.
Affected Products
Mikado-Themes GrandPrix WordPress theme: versions from initial release through 1.6 inclusive. CPE string (inferred): cpe:2.3:a:mikado-themes:grandprix:*:*:*:*:*:wordpress:*:*. Affected installations include: (1) Any WordPress site running GrandPrix theme versions ≤1.6, (2) Multisite WordPress networks using this theme, (3) WooCommerce or e-commerce sites leveraging GrandPrix for storefront functionality. No vendor advisory link was provided in the input data; vendors/users should check Mikado-Themes official site, WordPress.org theme repository, or CVE databases for patch availability.
Remediation
Immediate actions: (1) Upgrade GrandPrix theme to version > 1.6 if a patched version is available from Mikado-Themes (verify on wordpress.org or vendor site); (2) If no patch is available, disable or remove the GrandPrix theme and switch to an alternative WordPress theme; (3) Implement Web Application Firewall (WAF) rules to block path traversal patterns (../, ..\ null bytes, unicode encoding variations) in HTTP requests to affected theme directories; (4) Apply WordPress security hardening: disable file editing (DISALLOW_FILE_EDIT), restrict file upload locations, apply principle of least privilege to file permissions; (5) Review server logs and file access logs for evidence of exploitation (unusual ../ patterns, inclusion of /etc/passwd, wp-config.php, or other sensitive files). Workaround (temporary): disable the theme via wp-config.php or via database if admin access is available, pending patch deployment.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today