Medium severity4.9NVD Advisory· Published Apr 5, 2021· Updated Jun 17, 2026

CVE-2021-24154

Description

The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Themeeditor/Theme Editor
cpe:2.3:a:themeeditor:theme_editor:*:*:*:*:*:wordpress:*:*
Range: <2.6
WordPress/Theme Editordescription
WordPress/Theme Editorllm-fuzzy
Range: <2.6
Package: https://wordpress.org/plugins/theme-editor

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/566c6836-fc3d-4dd9-b351-c3d9da9ec22envdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.319
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000