PT-2026-28275 · WordPress · Restaurant Cafeteria

Khaled Alenazi · Publicado 2026-03-28 · Atualizado 2026-03-28 · CVE-2025-15445

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Restaurant Cafeteria WordPress theme versions through 0.4.6

Description The WordPress theme allows any logged-in user, including those with subscriber privileges, to perform actions intended for more privileged roles due to missing security checks. Specifically, insecure admin-ajax actions lack nonce and capability verification. This allows an attacker to install and activate plugins from URLs controlled by the attacker, potentially leading to arbitrary PHP code execution. The theme also allows importing demo content that can overwrite site configurations, including pages, menus, and front page settings.

Recommendations Update Restaurant Cafeteria WordPress theme to a version newer than 0.4.6.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-15445

Produtos afetados

Restaurant Cafeteria

Referências · 4

• 🔥 https://wpscan.com/vulnerability/f3f4a734-5828-4e3f-a170-28189aeda929 · Exploit
• https://twitter.com/cyberbivash/status/2037789314403168687 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2037929294413111523 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-15445 · Nota de Segurança