EUVD-2025-17551
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Path Traversal vulnerability in Mikado-Themes Grill and Chow allows PHP Local File Inclusion. This issue affects Grill and Chow: from n/a through 1.6.
Analysis
Path traversal vulnerability in Mikado-Themes Grill and Chow WordPress themes (versions through 1.6) that enables PHP Local File Inclusion (LFI) attacks. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary files on the affected server, potentially exposing sensitive configuration files, database credentials, and other confidential data. The high CVSS score of 8.1 reflects significant impact on confidentiality and integrity, though exploitation requires higher attack complexity.
Technical Context
This vulnerability exploits improper input validation in file path handling within the Grill and Chow theme codebase. The root cause is classified under CWE-35 (Path Traversal), which occurs when user-controlled input is used to construct file paths without adequate sanitization or validation. Attackers can inject path traversal sequences (e.g., '../../../') to navigate outside intended directories and include arbitrary files via PHP inclusion functions (include(), require(), file_get_contents(), etc.). The vulnerability affects WordPress theme components that handle file operations, likely in template loading, asset inclusion, or custom functionality handlers. CPE identification points to Mikado-Themes products, specifically the Grill and Chow theme distribution across WordPress installations running affected versions.
Affected Products
Grill (1.6 and earlier); Chow (1.6 and earlier)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today