CVE-2021-24154: Theme Editor < 2.6 - Authenticated Arbitrary File Download

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-05 · updated 2026-06-17
Weakness: CWE-552

Description

The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd

Affected products

mndpsingh287 Theme Editor: before 2.6 — fixed in 2.6

How to fix

Upgrade to a fixed version: mndpsingh287 Theme Editor 2.6. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/566c6836-fc3d-4dd9-b351-c3d9da9ec22e
https://wpscan.com/vulnerability/566c6836-fc3d-4dd9-b351-c3d9da9ec22e

Get alerted when CVE-2021-24154 or the next vulnerability affects your stack