CVE-2025-31040: WP Food Plugin Path Traversal Vulnerability

CVE-2025-31040 Overview

CVE-2025-31040 is a PHP Local File Inclusion (LFI) vulnerability in the Exthemes WP Food ordering and Restaurant Menu (wp-food) WordPress plugin. The flaw stems from improper control of filenames passed to PHP include/require statements [CWE-98]. Attackers can exploit the issue over the network without authentication or user interaction, though successful exploitation requires meeting specific conditions reflected in the high attack complexity. All versions of the plugin up to and including 2.7 are affected.

Critical Impact
Successful exploitation allows attackers to include and execute arbitrary local PHP files on the WordPress host, leading to disclosure of sensitive data, code execution, and full compromise of the affected site.

Affected Products

Exthemes WP Food ordering and Restaurant Menu (wp-food) plugin for WordPress
All versions from initial release through 2.7
WordPress sites running the vulnerable wp-food plugin

Discovery Timeline

2025-04-11 - CVE-2025-31040 published to the National Vulnerability Database (NVD)
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-31040

Vulnerability Analysis

The vulnerability resides in the wp-food plugin's handling of file paths passed to PHP file inclusion functions. The plugin accepts attacker-influenced input and uses it in include, require, include_once, or require_once calls without adequate validation or sanitization. The classification under [CWE-98] confirms improper control of filename for include/require statements. While the advisory describes the issue as PHP Remote File Inclusion, the confirmed impact is Local File Inclusion, allowing attackers to load any PHP-readable file on the server into the request context.

Root Cause

The root cause is missing input validation on a parameter that controls a dynamic file inclusion path. The plugin trusts user-supplied data when constructing the path argument to a PHP inclusion function. PHP then resolves and executes the referenced file in the context of the WordPress process, bypassing any access control normally enforced at the web routing layer.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to a vulnerable wp-food endpoint, supplying a path that resolves to a sensitive file or attacker-staged content on the server. The EPSS score is 0.547% (68th percentile), reflecting moderate predicted exploitation likelihood. The attack requires no privileges or user interaction but has higher complexity, suggesting the attacker must satisfy specific path resolution or configuration constraints.

No verified public exploit code is available. See the Patchstack WP Food Vulnerability Advisory for vendor-coordinated technical details.

Detection Methods for CVE-2025-31040

Indicators of Compromise

HTTP requests to wp-food plugin endpoints containing directory traversal sequences such as ../, ..%2f, or absolute paths like /etc/passwd
Unexpected PHP errors or warnings in web server logs referencing include() or require() with attacker-controlled paths
WordPress process accessing sensitive system files (for example wp-config.php, /etc/passwd, log files) outside normal operation
New or modified PHP files in the wp-content/uploads/ directory following suspicious request activity

Detection Strategies

Inspect web server and WordPress access logs for requests targeting wp-food plugin paths with file path parameters
Deploy web application firewall (WAF) rules that flag path traversal patterns and known LFI payloads on plugin URLs
Correlate inbound requests to plugin endpoints with subsequent PHP process file reads on sensitive paths
Monitor for plugin version wp-food <= 2.7 in WordPress asset inventories

Monitoring Recommendations

Enable PHP error logging and forward logs to a centralized SIEM for anomaly analysis
Alert on any read access to wp-config.php or other secrets-bearing files by the web server user
Track plugin and theme inventory across WordPress fleets to identify exposed wp-food installations
Baseline normal request parameters to plugin endpoints and alert on deviations containing path characters

How to Mitigate CVE-2025-31040

Immediate Actions Required

Identify all WordPress installations running the Exthemes wp-food plugin at version 2.7 or earlier
Deactivate and remove the wp-food plugin from affected sites until a patched version is confirmed installed
Restrict access to WordPress administrative and plugin endpoints behind authentication or IP allow-lists where feasible
Review web server logs for prior exploitation attempts targeting plugin parameters

Patch Information

At the time of NVD publication, the advisory lists affected versions through 2.7 with no confirmed fixed version. Monitor the Patchstack WP Food Vulnerability Advisory and the plugin vendor's release notes for an official patched build, and update immediately once available.

Workarounds

Remove the wp-food plugin entirely if a patched version is not yet available
Deploy WAF signatures that block path traversal sequences and absolute filesystem paths in requests to wp-food endpoints
Apply PHP open_basedir restrictions to limit which directories the WordPress process can include or read
Disable allow_url_include in php.ini to prevent escalation to remote file inclusion vectors

bash

# Example PHP hardening in php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"