The Restaurant Cafeteria WordPress theme through version 0.4.6 exposes admin‑ajax actions that lack nonce and capability checks. Consequently, any logged‑in user, including subscribers, can trigger privileged operations. An attacker can instruct the site to install and activate a plugin from a supplied URL, which results in execution of arbitrary PHP code. The flaw also permits importing demo content that rewrites site configuration, including theme settings, pages, menus, and front‑page settings, effectively compromising the entire website configuration.

The vulnerability impacts installations of the Restaurant Cafeteria theme version 0.4.6 and earlier on WordPress sites. It applies to sites that allow subscriber accounts to authenticate and use the theme's features.

The CVSS score of 5.4 indicates moderate severity; the EPSS score is below 1% and the flaw is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread public exploitation. Nevertheless, because the attack requires only a logged‑in WordPress user, and the description notes that a subscriber can trigger the vulnerable actions, an attacker can easily compromise a site with full code execution and site takeover capabilities.