The Grand Restaurant WordPress theme contains an improper limitation of a pathname to a restricted directory, allowing an attacker to traverse beyond the intended folder via exploited input parameters. This Path Traversal flaw (CWE-22) could enable an attacker to read sensitive files from the server or inject malicious PHP objects, leading to elevated privileges or remote code execution if further exploitation steps are applied.

WordPress sites that use the ThemeGoods Grand Restaurant theme version 7.0 or earlier are affected. The flaw exists in all releases from the earliest release up to and including version 7.0. No patch version is specified in the CVE data.

The CVSS score of 9.8 classifies the vulnerability as critical, indicating high likelihood of success and severe impact if exploited. The EPSS score of less than 1% suggests a low probability of widespread exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves maliciously crafted URLs or input fields that the theme processes, potentially allowing an unauthenticated attacker to traverse directories and read or execute files.