CVE-2025-31040: WordPress WP Food ordering and Restaurant Menu plugin <= 2.7 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Exthemes WP Food ordering and Restaurant Menu wp-food allows PHP Local File Inclusion.This issue affects WP Food ordering and Restaurant Menu: from n/a through <= 2.7.
Other sources
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NotFound WP Food ordering and Restaurant Menu allows PHP Local File Inclusion. This issue affects WP Food ordering and Restaurant Menu: from n/a through 1.1.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31040?
CVE-2025-31040 is classified as a high severity Local File Inclusion vulnerability.
How do I fix CVE-2025-31040?
To fix CVE-2025-31040, update the WP Food ordering and Restaurant Menu plugin to version 2.8 or later.
Which versions are affected by CVE-2025-31040?
CVE-2025-31040 affects versions of the WP Food ordering and Restaurant Menu plugin up to and including 2.7.
What type of vulnerability is CVE-2025-31040?
CVE-2025-31040 is a Local File Inclusion vulnerability that allows attackers to include files on the server.
Who is the vendor of the affected software for CVE-2025-31040?
The vendor of the affected software for CVE-2025-31040 is Exthemes, associated with the WP Food ordering and Restaurant Menu plugin.