CVE-2021-24154CWE-552

Theme Editor < 2.6 - Authenticated Arbitrary File Download

published April 5, 2021

CVSS
—
EPSS
1%
Percentile
64.5
In the wild
Unconfirmed
What it is

The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01066 · 64.5th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2021-04-05T18:27Z
EPSS history
Timeline
  • 05 APR 18:27Z
    Theme Editor < 2.6 - Authenticated Arbitrary File Download
    cvelistv5