Food Drop CVE-2025-69125

Target site must run the Food Drop WordPress theme at version ≤1.3 with the vulnerable PHP include path reachable over HTTP(S); no authentication, no user interaction, and no special privileges are required (PR:N/UI:N). Exploitation is limited by AC:H, indicating the attacker must satisfy a non-trivial condition such as identifying the correct theme parameter, traversal depth, and file extension handling, and full RCE (versus pure file read) additionally depends on PHP being configured with allow_url_include=On or on the attacker controlling a local file whose contents can be included as PHP.

Signals are mixed and warrant cautious prioritization. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H yields 8.1 (High), driven by network reach, no authentication, no user interaction, and full CIA impact - consistent with LFI that can lead to credential disclosure or code execution. AC:H tempers this, implying some non-trivial condition (e.g. a specific parameter or context) must be met. No EPSS score, KEV listing, SSVC decision, or public POC was provided, so there is no current evidence of active exploitation or automatable mass scanning. Net assessment: this is a real, prioritizable issue for any site running Food Drop ≤1.3, but it is not currently a confirmed exploitation event; treat as a high-priority patch item rather than an emergency unless telemetry indicates otherwise.

A remote, unauthenticated attacker discovers a Food Drop theme endpoint that accepts a file/template parameter and submits a crafted value containing path traversal (e.g. ../../../../wp-config.php%00 or a similar payload tailored to the vulnerable include) to read WordPress database credentials, then pivots to the database or uploads a PHP payload that is later included to gain code execution. AC:H reflects that the attacker may need to identify the specific vulnerable parameter and a working traversal depth, and no public POC is currently documented.