CVE-2025-32926 WordPress Grand Restaurant WordPress theme <= 7.0 - Path Traversal to PHP Object Injection vulnerability
Attackers can exploit path traversal to achieve PHP object injection in the Grand Restaurant WordPress theme.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-32926?
CVE-2025-32926 is a critical path traversal vulnerability in ThemeGoods Grand Restaurant, published on 19 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Path Traversal.This issue affects Grand Restaurant: from n/a through <= 7.0.
Weakness: CWE-22
Which versions are affected by CVE-2025-32926?
It affects 1 product.
Products include Themegoods Grand Restaurant.
How do I fix CVE-2025-32926?
No fix has been published for CVE-2025-32926 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-32926 being exploited?
There is no known exploitation of CVE-2025-32926 in the wild and no public exploit code.
Other vulnerabilities in ThemeGoods Grand Restaurant
- CVE-2025-39348 WordPress Grand Restaurant WordPress theme <= 7.0 - PHP Object Injection vulnerability
- CVE-2025-39352 WordPress Grand Restaurant WordPress theme <= 7.0 - Arbitrary Options Deletion vulnerability
- CVE-2025-67922 WordPress Grand Restaurant theme < 7.0.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-39353 WordPress Grand Restaurant WordPress theme <= 7.0 - Broken Access Control vulnerability
- CVE-2025-39351 WordPress Grand Restaurant WordPress theme <= 7.0 - Cross Site Request Forgery (CSRF) vulnerability
Sources
Also known as GHSA-7c8r-v4x3-jvvm.