Technical impact
The vulnerability is an improper control of filename for include/require statements in the Fooddy theme. A malicious actor can manipulate the file path in a request so that the theme includes local files on the server. This can lead to disclosure of sensitive data or execution of arbitrary code, effectively giving an attacker remote code execution or privilege escalation.
Affected Systems
AncoraThemes Fooddy theme versions through and including 1.3.10 are affected. The issue does not apply to versions newer than 1.3.10.
Risk and Exploitability
The CVSS v3.1 score is 8.1, placing the vulnerability in the high severity range. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote unauthenticated request that abuses the vulnerable include mechanism, allowing the attacker to request arbitrary local files or inject malicious code.
