The vulnerability CVE-2025-31040 affects Exthemes WP Food ordering and Restaurant Menu plugin versions up to 2.7. It arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow attackers to execute arbitrary local files on the server, leading to high impact on confidentiality, integrity, and availability. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on all three security properties. There is no vendor advisory or patch information available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary local files on the server hosting the vulnerable plugin. This may lead to full compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score (8.1) indicates significant risk if exploited. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.