Arbitrary File Upload Vulnerability in Streamit Theme for WordPress

CVE-2025-2525

What is CVE-2025-2525?

The Streamit theme for WordPress is exposed to security risks due to inadequate file type validation in the 'st_Authentication_Controller::edit_profile' function. This flaw allows authenticated users, possessing subscriber-level permissions or higher, to upload arbitrary files to the server, potentially leading to remote code execution. Site administrators using Streamit theme versions 4.0.1 and earlier should take immediate actions to mitigate this risk by updating to the latest version or implementing appropriate security measures.

References