CVE-2025-60125: FoodBook Information Disclosure Issue

CVE-2025-60125 Overview

CVE-2025-60125 is a sensitive information disclosure vulnerability in the themelooks FoodBook WordPress plugin. The flaw affects all versions up to and including 4.7.6. An unauthenticated remote attacker can retrieve embedded sensitive data through network-based requests without user interaction. The issue is categorized under [CWE-201]: Insertion of Sensitive Information Into Sent Data. Exploitation requires no privileges and no user interaction, but the impact is limited to confidentiality of low-value data. The vulnerability was published to the National Vulnerability Database (NVD) on September 26, 2025, and originates from a Patchstack advisory tracking WordPress plugin security issues.

Critical Impact
Unauthenticated attackers can retrieve embedded sensitive data from the FoodBook plugin over the network without any privileges or user interaction.

Affected Products

themelooks FoodBook WordPress plugin, versions n/a through <= 4.7.6
WordPress installations running the FoodBook plugin for restaurant and food ordering functionality
Sites exposing FoodBook plugin endpoints to unauthenticated network traffic

Discovery Timeline

2025-09-26 - CVE-2025-60125 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60125

Vulnerability Analysis

The vulnerability stems from improper handling of sensitive data within responses generated by the FoodBook plugin. The plugin embeds sensitive information into data sent to clients that should not have access to it. Because the exposure occurs over the network and requires no authentication, any remote actor can trigger the disclosure by interacting with the affected plugin endpoints.

The issue maps to [CWE-201], which covers scenarios where an application inserts sensitive data into transmitted content accessible to unintended parties. The Exploit Prediction Scoring System (EPSS) currently rates the probability of exploitation at a low level, and no public proof-of-concept has been observed. However, WordPress plugin vulnerabilities of this class are frequently automated by opportunistic scanners.

Root Cause

The root cause is the plugin's failure to filter or redact sensitive fields before returning data in HTTP responses. FoodBook versions up to 4.7.6 include information in response payloads that should be restricted to authorized users or omitted entirely. This design flaw allows the data to be retrieved by any client capable of issuing requests to the plugin.

Attack Vector

An attacker sends crafted HTTP requests to endpoints exposed by the FoodBook plugin on a target WordPress site. The server responds with data that embeds sensitive information. The attacker parses these responses to extract the exposed content. Full technical details are available in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-60125

Indicators of Compromise

Unauthenticated HTTP requests to FoodBook plugin endpoints under /wp-content/plugins/foodbook/ or FoodBook-related REST API routes
Repeated automated scans probing WordPress wp-json endpoints associated with the FoodBook plugin
HTTP responses from FoodBook endpoints containing unexpected sensitive fields in JSON or HTML output

Detection Strategies

Inventory WordPress installations and identify sites running FoodBook version 4.7.6 or earlier using plugin management or WPScan-style enumeration
Review web server access logs for unauthenticated requests to FoodBook plugin paths with abnormal frequency or from suspicious sources
Deploy web application firewall (WAF) rules to inspect responses from FoodBook endpoints for sensitive data patterns

Monitoring Recommendations

Alert on anomalous outbound response sizes from WordPress sites hosting the FoodBook plugin
Monitor for external requests originating from IP ranges known for WordPress vulnerability scanning
Correlate WordPress plugin version telemetry with published CVE data to prioritize vulnerable hosts

How to Mitigate CVE-2025-60125

Immediate Actions Required

Identify all WordPress sites running the themelooks FoodBook plugin at version 4.7.6 or earlier
Update the FoodBook plugin to a version later than 4.7.6 once the vendor releases a patched release
Restrict access to FoodBook endpoints at the web server or WAF layer until patching is complete

Patch Information

At the time of publication, the Patchstack Vulnerability Report tracks the issue as affecting FoodBook through 4.7.6. Administrators should monitor the themelooks vendor channel and the WordPress plugin repository for a fixed release and apply it immediately upon availability.

Workarounds

Disable the FoodBook plugin if it is not actively required for site operations
Place the WordPress site behind a WAF configured to block requests to vulnerable FoodBook endpoints
Apply IP allowlisting to restrict access to FoodBook administrative and API endpoints to trusted addresses

bash

# Example: block external access to FoodBook plugin paths via nginx
location ~* /wp-content/plugins/foodbook/ {
    deny all;
    return 403;
}