Streamit WordPress Theme Arbitrary File Download Vulnerability

A vulnerability allowing arbitrary file downloads has been identified in the Streamit theme for WordPress, affecting all versions through 4.0.1. This issue arises from inadequate file validation in the 'st_send_download_file' function, enabling authenticated attackers with subscriber-level access or higher to download arbitrary files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server.

Remediation

Users are advised to update the Streamit WordPress theme to version 4.0.2 or a newer patched version.