Executive brief
The Food Drop theme for WordPress is vulnerable to a security flaw that allows unauthorized individuals to access sensitive files on the web server. By exploiting this, an attacker could potentially view configuration files containing database credentials, leading to a full takeover of the website and its data. This vulnerability is particularly serious as it does not require a login to exploit.
Technical details
The Food Drop theme for WordPress, up to and including version 1.3, is vulnerable to Local File Inclusion (LFI) due to improper control of filenames used in PHP include/require statements (CWE-98). An unauthenticated remote attacker can exploit this vulnerability to read sensitive local files on the server, such as wp-config.php, by manipulating input parameters. While the CVSS vector indicates high complexity (AC:H), the impact is high across confidentiality, integrity, and availability. As of the advisory date, no official patch has been released by the vendor, and users are advised to seek alternative mitigation strategies like web application firewalls.
Affected products
- ThemeREX Food Drop <= 1.3
Timeline
- 2025-10-15: other: Reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity)
- 2026-05-26: advisory: Patchstack published advisory details
- 2026-06-17: disclosed: CVE published to NVD