The vulnerability identified as CVE-2025-32926 affects ThemeGoods Grand Restaurant plugin versions up to 7.0. It is an improper limitation of a pathname to a restricted directory, commonly known as a path traversal vulnerability. This allows remote attackers to access arbitrary files on the server by manipulating file path inputs. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no patch or mitigation details have been provided by the vendor. The product is not a cloud service, so remediation depends on vendor patch releases.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to read, modify, or delete arbitrary files on the affected system, potentially leading to full system compromise. The high CVSS score indicates critical impact on confidentiality, integrity, and availability of the system running the vulnerable plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin or applying compensating controls such as web application firewalls to detect and block path traversal attempts. Monitor ThemeGoods advisories for updates and apply patches promptly once available.