VW Food Corner CVE-2026-57774

Exploitation requires that the target WordPress installation has the VW Food Corner theme installed and active at version 1.1.0 or earlier. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, user interaction, or special network positioning is required - any unauthenticated remote attacker can attempt exploitation over standard HTTP/HTTPS. The primary limiting factor is product specificity: only sites running this niche restaurant-focused WordPress theme are at risk. A secondary limiting factor is impact scope: the exploitable unguarded functionality produces only low availability impact (A:L) per the CVSS assessment, meaning even successful exploitation causes limited disruption. No special server configuration, plugin combination, or non-default WordPress setting is identified as a prerequisite in the available data.

The CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L reflects a remotely exploitable, low-complexity flaw requiring no authentication or user interaction, but with impact capped at low availability only - no confidentiality or integrity degradation. This impact ceiling significantly limits real-world severity compared to typical authorization bypass findings. No EPSS score was provided in the available intelligence, and the vulnerability is absent from CISA KEV, meaning no confirmed in-the-wild exploitation exists. No public proof-of-concept code has been identified. The combination of missing KEV listing, absent EPSS data, niche product footprint, and low impact scope places this vulnerability in a low operational priority tier for most organizations. Risk is primarily relevant to WordPress site operators running this specific restaurant theme, where the practical blast radius of the exploitable function constrains real-world damage.

An unauthenticated attacker discovers a WordPress site running VW Food Corner theme version 1.1.0 or earlier - identifiable via page source meta tags or WordPress theme enumeration. The attacker sends a crafted HTTP POST request to the site's wp-admin/admin-ajax.php endpoint (or equivalent REST route) targeting the unprotected theme action, which executes without any authorization check, triggering a minor availability disruption such as resetting theme configuration or invoking a resource-intensive process. No public exploit code is known at time of analysis, but the low attack complexity (AC:L) and absence of prerequisites make manual exploitation straightforward once the vulnerable action hook is identified.