Security Advisory

CVE-2018-25437

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-06-15 12:00:51

Last updated 2026-06-15 19:24:18

Assigner VulnCheck

CVSS score 8.7

State PUBLISHED

Description

WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download_backup.php endpoint. Attackers can directly access the download_backup.php script in the admin/data_management directory to obtain ZIP archives containing the entire wp-content/themes directory contents.

← Browse all CVEs View on cve.org ↗