WordPress Theme Editor plugin <= 2.5 - Multiple Authenticated Arbitrary File Download vulnerabilities - Patchstack

Vulnerability Database

WordPress Theme Editor plugin <= 2.5 - Multiple Authenticated Arbitrary File Download vulnerabilities

theme-editor

Software

Theme Editor

Versions

<= 2.5

Disclosure date

2021-02-13

CVE

CVE-N/A

References

Vulnerability details
Plugin changelog

Credits

Nguyen Van Khanh

Classification

Arbitrary File Download

OWASP Top 10

A6: Sensitive Data Exposure

Are your websites subject to this vulnerability?

Details

Multiple Authenticated Arbitrary File Download vulnerabilities found by Nguyen Van Khanh and WPScan security research team in WordPress Theme Editor plugin (versions <= 2.5).

Solution

Update the WordPress Theme Editor plugin to the latest available version (at least 2.6).

Found a vulnerability that puts your sites at risk?

Found a vulnerability? Help us secure the web and join our community of ethical hackers.

Are you the developer of this software? Hire our researchers for a thorough security audit.