PT-2026-49224 · WordPress · Cherryframework Themes

CVE-2018-25437

·

Published

2026-06-15

·

Updated

2026-06-15

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions WordPress CherryFramework Themes version 3.1.4
Description An information disclosure issue allows unauthenticated attackers to download sensitive backup files. By accessing the 'download backup.php' endpoint located in the 'admin/data management' directory, attackers can obtain ZIP archives containing the entire contents of the wp-content/themes directory.
Recommendations For version 3.1.4, restrict access to the 'download backup.php' script in the 'admin/data management' directory to prevent unauthorized downloads.

Fix

Missing Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2018-25437

Affected Products

Cherryframework Themes