CVE-2025-15445: Restaurant Cafeteria WordPress RCE Flaw

CVE-2025-15445 Overview

CVE-2025-15445 is a Missing Authorization vulnerability (CWE-862) affecting the Restaurant Cafeteria WordPress theme through version 0.4.6. The theme exposes insecure admin-ajax actions without nonce or capability checks, allowing any logged-in user, including subscribers with minimal privileges, to perform privileged operations. An attacker can install and activate plugins from a user-supplied URL, leading to arbitrary PHP code execution. Additionally, the vulnerability allows importing demo content that rewrites site configuration, including theme mods, pages, menus, and front page settings.

Critical Impact

Authenticated attackers with minimal privileges (subscriber role) can achieve arbitrary PHP code execution by installing malicious plugins and completely rewrite WordPress site configuration.

Affected Products

• Restaurant Cafeteria WordPress theme versions through 0.4.6

Discovery Timeline

• 2026-03-28 - CVE CVE-2025-15445 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2025-15445

Vulnerability Analysis

This vulnerability stems from a fundamental failure to implement proper authorization controls on WordPress AJAX actions. The Restaurant Cafeteria theme registers admin-ajax endpoints that handle sensitive operations such as plugin installation and site configuration imports without verifying user capabilities or validating nonce tokens.

When WordPress plugins or themes register AJAX handlers using wp_ajax_ hooks, they should always verify that the requesting user has appropriate capabilities for the requested action and that the request includes a valid nonce to prevent cross-site request forgery. The Restaurant Cafeteria theme neglects both of these critical security controls, creating a privilege escalation pathway from any authenticated user to full administrative capabilities.

The impact is severe because WordPress subscribers—the lowest authenticated user role—can exploit this vulnerability to install arbitrary plugins from external URLs. Since WordPress plugins can contain any PHP code that executes with full server privileges, this effectively grants remote code execution to any authenticated attacker.

Root Cause

The root cause is the absence of proper authorization checks in the theme's AJAX handler implementations. The vulnerable code fails to call current_user_can() to verify that the requesting user has administrator capabilities before performing privileged operations. Additionally, the code does not use wp_verify_nonce() or check_ajax_referer() to validate request authenticity, making the endpoints vulnerable to both direct exploitation and cross-site request forgery attacks.

Attack Vector

The attack can be executed remotely over the network by any authenticated user. The attacker first authenticates to the WordPress site with a low-privilege account such as a subscriber. They then craft a malicious AJAX request to the vulnerable endpoint, specifying a URL pointing to a malicious WordPress plugin package. The theme processes this request without verifying the user's authorization level, downloads the plugin, and installs it. The attacker can then trigger activation of the malicious plugin, achieving arbitrary PHP code execution on the server.

Alternatively, an attacker can abuse the demo content import functionality to overwrite critical site settings, redirecting the front page, modifying menus, or otherwise defacing the site.

Detection Methods for CVE-2025-15445

Indicators of Compromise

• Unexpected plugin installations, especially plugins from non-standard sources or with suspicious names
• AJAX requests to admin-ajax.php with actions related to plugin installation or demo import from subscriber or other low-privilege user sessions
• Sudden changes to site configuration including front page settings, menus, and theme modifications
• Web server access logs showing POST requests to admin-ajax.php from user accounts that should not have administrative capabilities

Detection Strategies

• Monitor WordPress audit logs for plugin installations performed by non-administrator users
• Implement web application firewall (WAF) rules to detect suspicious AJAX action parameters targeting plugin installation endpoints
• Review WordPress user activity logs for subscribers or other low-privilege users making administrative-level requests
• Configure file integrity monitoring to alert on new plugin directories or modified theme configuration files

Monitoring Recommendations

• Enable WordPress security plugins with activity logging capabilities to track all administrative actions
• Set up alerts for any plugin installation events that were not initiated through the standard WordPress admin interface
• Monitor for outbound connections from the WordPress server to unknown URLs that could indicate plugin downloads from malicious sources
• Implement regular file system scans to detect unauthorized plugin installations or configuration changes

How to Mitigate CVE-2025-15445

Immediate Actions Required

• Upgrade the Restaurant Cafeteria WordPress theme to a patched version when available from the vendor
• If no patch is available, consider deactivating and removing the Restaurant Cafeteria theme until a fix is released
• Audit the WordPress installation for any unauthorized plugins that may have been installed through exploitation
• Review and revoke subscriber and other low-privilege user accounts that are not essential
• Implement additional access controls through a WordPress security plugin to restrict AJAX endpoint access

Patch Information

For detailed vulnerability information and patch status, refer to the WPScan Vulnerability Advisory. Check the theme vendor's website or the WordPress theme repository for updated versions that address this vulnerability.

Workarounds

• Disable user registration on the WordPress site to prevent attackers from creating authenticated accounts
• Implement server-level access controls to restrict access to admin-ajax.php for specific user roles
• Use a WordPress security plugin to add capability checks to AJAX endpoints
• Consider deploying a web application firewall with rules to block suspicious plugin installation requests
• Temporarily switch to an alternative restaurant or cafeteria-themed WordPress theme that does not contain this vulnerability