CVE-2025-2526: Authorization Bypass Through User-Controlled Key

The Streamit theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like email in the 'stAuthenticationController::editprofile'...

WordPress Streamit Theme <= 4.0.1 is vulnerable to Arbitrary File Download

Software Streamit Type Theme Vulnerable versions = 4.0.1 Fixed in 4.0.2 OWASP Top 10 A3: Injection Classification Arbitrary File Download CVE CVE-2025-2519 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 446a13c89b70 Credits István Márton Required privilege Subscriber...