PT-2026-28275 · WordPress · Restaurant Cafeteria

Khaled Alenazi · Published 2026-03-28 · Updated 2026-03-28 · CVE-2025-15445

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Restaurant Cafeteria WordPress theme versions through 0.4.6

Description The WordPress theme allows any logged-in user, including those with subscriber privileges, to perform actions intended for more privileged roles due to missing security checks. Specifically, insecure admin-ajax actions lack nonce and capability verification. This allows an attacker to install and activate plugins from URLs controlled by the attacker, potentially leading to arbitrary PHP code execution. The theme also allows importing demo content that can overwrite site configurations, including pages, menus, and front page settings.

Recommendations Update Restaurant Cafeteria WordPress theme to a version newer than 0.4.6.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-15445

Affected Products

Restaurant Cafeteria

References · 4

• 🔥 https://wpscan.com/vulnerability/f3f4a734-5828-4e3f-a170-28189aeda929 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15445 · Security Note
• https://twitter.com/cyberbivash/status/2037789314403168687 · Twitter Post
• https://twitter.com/CVEarity/status/2037929294413111523 · Twitter Post