Arbitrary File Download Vulnerability in Streamit WordPress Theme

CVE-2025-2519

What is CVE-2025-2519?

The Streamit theme for WordPress is susceptible to an arbitrary file download vulnerability owing to inadequate file validation within the 'st_send_download_file' function. This flaw enables authenticated attackers, including those with subscriber-level access or higher, to exploit this weakness and download any file from the server, posing significant risks to data privacy and security. Proper validation mechanisms should be implemented to mitigate this issue effectively.

References