Description
Path Traversal: '.../...//' vulnerability in Mikado-Themes Grill and Chow grillandchow allows PHP Local File Inclusion.This issue affects Grill and Chow: from n/a through <= 1.6.
Published: 2025-06-09
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a path traversal flaw that permits PHP local file inclusion within the Mikado-Themes Grill and Chow WordPress theme. It is classified as CWE‑35 and allows an attacker to request the theme to include arbitrary files from the server, potentially exposing sensitive files or code base when the theme attempts to process them.

Affected Systems

WordPress installations that use the Mikado‑Themes Grill and Chow theme version 1.6 or earlier are affected.

Risk and Exploitability

The CVSS score of 8.1 signifies a high severity, yet the EPSS score of less than 1% indicates that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a specially crafted URL or input that uses the theme’s file inclusion mechanism to traverse outside its intended directory.

Generated by OpenCVE AI on April 30, 2026 at 18:07 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Grill and Chow theme to the latest version that removes the vulnerability
  • If an upgrade is not immediately possible, modify or harden the theme’s file inclusion logic and restrict the directories that can be referenced
  • Deploy a web application firewall or security plugin configured to detect and block local file inclusion attempts

Generated by OpenCVE AI on April 30, 2026 at 18:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-17551 Path Traversal vulnerability in Mikado-Themes Grill and Chow allows PHP Local File Inclusion. This issue affects Grill and Chow: from n/a through 1.6.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Path Traversal vulnerability in Mikado-Themes Grill and Chow allows PHP Local File Inclusion. This issue affects Grill and Chow: from n/a through 1.6. Path Traversal: '.../...//' vulnerability in Mikado-Themes Grill and Chow grillandchow allows PHP Local File Inclusion.This issue affects Grill and Chow: from n/a through <= 1.6.
Title WordPress Grill and Chow <= 1.6 - Local File Inclusion Vulnerability WordPress Grill and Chow theme <= 1.6 - Local File Inclusion Vulnerability
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Thu, 29 Jan 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Qodeinteractive
Qodeinteractive grill And Chow
CPEs cpe:2.3:a:qodeinteractive:grill_and_chow:*:*:*:*:*:wordpress:*:*
Vendors & Products Qodeinteractive
Qodeinteractive grill And Chow

Fri, 11 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00061}

 epss

{'score': 0.00067}

Mon, 09 Jun 2025 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 09 Jun 2025 16:00:00 +0000

Type Values Removed Values Added
Description Path Traversal vulnerability in Mikado-Themes Grill and Chow allows PHP Local File Inclusion. This issue affects Grill and Chow: from n/a through 1.6.
Title WordPress Grill and Chow <= 1.6 - Local File Inclusion Vulnerability
Weaknesses CWE-35
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Qodeinteractive Grill And Chow
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:13:00.450Z

Reserved: 2025-06-04T09:41:51.340Z

Link: CVE-2025-49297

cve-icon Vulnrichment

Updated: 2025-06-09T17:17:49.659Z

cve-icon NVD

Status : Modified

Published: 2025-06-09T16:15:46.687

Modified: 2026-04-23T15:31:24.947

Link: CVE-2025-49297

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T18:15:06Z

Weaknesses