CVE-2025-0180

WP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validation

Published Feb 11, 2025 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.

Analysis

Technical impact

The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 4.7 because the plugin does not properly restrict which user metadata can be updated during profile registration. This flaw allows an attacker who does not possess login credentials to create a new user account that is granted full administrator privileges, effectively compromising the entire WordPress site.

Affected Systems

WordPress sites that have the WP Foodbakery plugin installed, specifically versions 4.7 and any earlier releases.

Risk and Exploitability

The vulnerability scores a CVSS of 9.8, indicating critical severity, yet the EPSS score is less than 1%, meaning the current likelihood of exploitation is very low. The CVE is not listed in CISA’s KEV catalog. Attackers can trigger the flaw by simply accessing the registration endpoint without authentication, submitting malicious role data, and having the plugin accept the request. While the score is high, the low exploitation probability and lack of a publicly known exploit reduce immediate risk, but the potential impact remains catastrophic if an attacker succeeds.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Chimpstudio

WP Foodbakery

unaffected

Version	Status	Constraints
`0`	affected	≤ 4.7

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update WP Foodbakery to the latest available version (greater than 4.7) to remediate the privilege escalation flaw.
If an update is unavailable, disable the plugin’s registration feature or modify the theme’s functions to restrict new user roles to non-administrator levels.
Audit existing user accounts for unexpected administrator privileges and remove any accounts created without proper authorization.

Generated by OpenCVE AI on April 21, 2026 at 22:23 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-1529	The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.522% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331
https://www.wordfence.com/threat-intel/vulnerabilities/id/d7140a6e-a528-428e-850e-5e4a481c5d7d?source=cve

History

Apr 8, 2026 6:30 PM Description updated View changes

Type	Values Removed	Values Added
Description	The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.	The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.7. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.

Jul 11, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00081}`	epss `{'score': 0.00107}`

Feb 11, 2025 4:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Feb 11, 2025 7:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The WP Foodbakery plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3. This is due to the plugin not properly restricting what user meta can be updated during profile registration. This makes it possible for unauthenticated attackers to register on the site as an administrator.
Title		WP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validation
Weaknesses		CWE-269
References		https://themeforest.net/item/food-bakery-restaurant-bakery-responsive-wordpress-theme/18970331 https://www.wordfence.com/threat-intel/vulnerabilities/id/d7140a6e-a528-428e-850e-5e4a481c5d7d?source=cve
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`