CVE-2021-24154

CVE-2021-24154: Theme Editor < 2.6 - Authenticated Arbitrary File Download

Vendor Unknown

Product Theme Editor

Weakness CWE-552 · Files accessible externally

Published April 5, 2021

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd

Key dates

02Disclosure timeline

April 5, 2021 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-24154 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/552.html AskarLabs — CWE-552 write-up Files or Directories Accessible to External Parties

Related vulnerabilities

04Related CVE

CVE-2025-14442 Secure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export File CVE-2022-1585 Project Source Code Download <= 1.0.0 - Unauthenticated Backup Download CVE-2025-12894 Import WP – Export and Import CSV and XML files to WordPress <= 2.14.17 - Unauthenticated Information Exposure CVE-2022-2357 WSM Downloader <= 1.4.0 - Unauthenticated Arbitrary File Download CVE-2025-12747 Tainacan <= 1.0.0 - Unauthenticated Information Exposure