PT-2026-49224 · Undefined · Undefined

Published 2026-06-15 · Updated 2026-06-15 · CVE-2018-25437

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download backup.php endpoint. Attackers can directly access the download backup.php script in the admin/data management directory to obtain ZIP archives containing the entire wp-content/themes directory contents.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2018-25437

Affected Products

Undefined

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-25437 · Security Note
• https://vulncheck.com/advisories/wordpress-cherryframework-themes-backup-file-download · Note
• https://exploit-db.com/exploits/45896 · Note
• http://cherryframework.com · Note