CVE-2021-24154: Themeeditor Theme Editor

Medium severity, CVSS 4.9. EPSS: 1.1% chance of exploitation in the next 30 days.

The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd

Affected products

• Themeeditor Theme Editor: before 2.6 (fixed in 2.6)

Published 2021-04-05. Last modified 2026-06-17.