CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download_backup.php endpoint. Attackers can directly access the download_backup.php script in the admin/data_management directory to obtain ZIP archives containing the entire wp-content/themes directory contents.
Explanation of Vulnerability in Simple Terms
Cherry Framework Themes versions 3.1.4 and later contain a missing authentication vulnerability that allows unauthenticated network attackers to read sensitive information. The vulnerability requires no user interaction and can be exploited remotely. Site administrators should update to a patched version when available.
What an attacker can do
Read sensitive information from the site without logging in.
Potential impact on your site
Confidential data may be exposed to anyone on the internet without needing site credentials.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
