CVE-2021-24154: Files or Directories Accessible to External Parties

The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the downloadfile function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd...

PT-2021-15699

Name of the Vulnerable Software and Affected Versions: Theme Editor WordPress plugin versions prior to 2.6 Description: The issue allows administrators to download arbitrary files on the web server, such as /etc/passwd, due to a lack of validation of the GET file parameter before it is passed to...