CVE-2025-39351 Overview
CVE-2025-39351 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the ThemeGoods Grand Restaurant WordPress theme. The flaw impacts all versions up to and including 7.0. An attacker can craft a malicious web page that, when visited by an authenticated user, triggers unintended state-changing actions in the WordPress site. The issue is tracked under CWE-352: Cross-Site Request Forgery. User interaction is required for exploitation, and successful attacks can lead to limited integrity impact on the affected site.
Critical Impact
Attackers can trick authenticated users into performing unintended actions on Grand Restaurant theme installations, resulting in unauthorized modifications to site configuration or content.
Affected Products
- ThemeGoods Grand Restaurant WordPress theme versions n/a through 7.0
- WordPress sites using the grandrestaurant theme
- Deployments running vulnerable versions without the vendor patch
Discovery Timeline
- 2025-05-19 - CVE-2025-39351 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-39351
Vulnerability Analysis
The vulnerability stems from missing or improperly validated anti-CSRF tokens on state-changing endpoints within the Grand Restaurant theme. WordPress themes typically use nonces generated via wp_create_nonce() and validated with check_admin_referer() or wp_verify_nonce() to prevent forged requests. In vulnerable versions of Grand Restaurant, one or more actions accept requests without validating a nonce or verifying request origin.
Exploitation requires an authenticated user, generally an administrator, to visit an attacker-controlled page while logged into the WordPress site. The malicious page issues a forged request to the vulnerable endpoint using the victim's session cookies. According to the Patchstack advisory, the issue affects all versions through 7.0.
The EPSS score is 0.128%, indicating a low probability of exploitation activity in the near term. No public proof-of-concept or in-the-wild exploitation has been reported.
Root Cause
The root cause is the absence of proper CSRF protection on one or more request handlers within the theme. Requests that modify server-side state should validate a nonce token tied to the user's session. Without this check, the browser's automatic inclusion of authentication cookies is sufficient to authenticate a forged cross-origin request.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker hosts a page containing a hidden form or JavaScript that auto-submits a request to the target WordPress site. When an authenticated user visits the attacker's page, the browser sends the request with valid session cookies. The vulnerable endpoint processes the request as legitimate, resulting in unauthorized configuration or content changes.
Refer to the Patchstack advisory for additional technical details.
Detection Methods for CVE-2025-39351
Indicators of Compromise
- Unexpected changes to theme configuration or theme options without a corresponding administrator action in the WordPress audit log
- POST requests to theme endpoints with Referer headers pointing to unrelated third-party domains
- Administrator sessions generating requests immediately after visiting external links or email attachments
Detection Strategies
- Inspect web server access logs for POST requests to Grand Restaurant theme endpoints containing off-site or missing Referer and Origin headers
- Compare current theme option values against known-good backups to identify unauthorized modifications
- Enable WordPress activity logging plugins to record option updates, user creations, and theme configuration changes
Monitoring Recommendations
- Monitor for anomalous administrator activity patterns, particularly configuration changes occurring outside normal working hours
- Alert on any theme file modifications and unauthorized changes to wp_options entries related to Grand Restaurant
- Review WordPress audit logs for state-changing actions lacking corresponding user-initiated navigation events
How to Mitigate CVE-2025-39351
Immediate Actions Required
- Identify all WordPress installations using the ThemeGoods Grand Restaurant theme and confirm version numbers
- Apply the vendor-provided update as soon as it becomes available from ThemeGoods
- Require administrators to log out of WordPress sessions before browsing untrusted sites
- Review recent administrator activity for signs of unauthorized configuration changes
Patch Information
At time of publication, the vulnerability affects Grand Restaurant versions up to and including 7.0. Consult the Patchstack advisory and the ThemeGoods vendor page for the latest fixed version and update instructions.
Workarounds
- Deploy a web application firewall (WAF) rule to block cross-origin POST requests to /wp-admin/ endpoints lacking valid Referer headers
- Restrict WordPress administrator access to a dedicated browser profile or session isolated from general web browsing
- Enforce strict SameSite=Strict cookie attributes on WordPress authentication cookies where feasible
- Limit administrative privileges to the minimum number of accounts required for site operations
# Configuration example - Apache mod_headers to enforce SameSite on WordPress cookies
Header edit Set-Cookie ^(wordpress_logged_in.*)$ "$1; SameSite=Strict; Secure"
Header edit Set-Cookie ^(wordpress_sec.*)$ "$1; SameSite=Strict; Secure"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
