Executive brief
UnTheme OrganicFood, a WordPress theme designed for food-related businesses, contains a security vulnerability that could allow an attacker to access sensitive server files. By exploiting this flaw, a malicious user with basic account access could potentially view configuration files containing database credentials or other private information. This could lead to a full compromise of the website's data and operations.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the UnTheme OrganicFood theme for WordPress (versions up to and including 3.6.4) due to improper validation of user-supplied input used in PHP include or require statements (CWE-98). An authenticated attacker with 'Contributor' level privileges can exploit this vulnerability to include arbitrary local files from the server. This can lead to the disclosure of sensitive information, such as the wp-config.php file, which may contain database credentials. While the CVSS vector indicates high complexity, the impact on confidentiality, integrity, and availability is high. As of the advisory date, no official patch has been released.
Affected products
- UnTheme OrganicFood <= 3.6.4
Timeline
- 2026-01-22: other: Vulnerability reported by researcher João Pedro S Alcântara
- 2026-02-21: disclosed: Vulnerability details published by Patchstack
- 2026-04-08: advisory: CVE published in NVD