title: Theme Editor < 2.6 - Authenticated Arbitrary File Download
description: The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web server, such as /etc/passwd
problem types: CWE-552 Files or Directories Accessible to External Parties
affected:
{
product: Theme Editor
vendor: Unknown
versions:
lessThan: 2.6, status: affected, version: 2.6, versionType: custom
}