CVE-2018-25437CWE-306

WordPress CherryFramework Themes 3.1.4 Backup File Download

High · published June 15, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
20.1
In the wild
Unconfirmed
What it is

WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download_backup.php endpoint. Attackers can directly access the download_backup.php script in the admin/data_management directory to obtain ZIP archives containing the entire wp-content/themes directory contents.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00287 · 20.1th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-06-15T12:00Z
EPSS history
Timeline
  • 15 JUN 12:00Z
    WordPress CherryFramework Themes 3.1.4 Backup File Download
    cvelistv5