Streamit WordPress Theme Arbitrary File Upload Vulnerability Allowing Remote Code Execution

A vulnerability allowing arbitrary file uploads has been identified in the Streamit theme for WordPress, in all versions through 4.0.1. This issue arises from inadequate file type validation in the 'st_Authentication_Controller::edit_profile' function. As a result, authenticated attackers with subscriber-level or higher permissions can upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution on the affected server.

Remediation

Users are advised to update the Streamit WordPress theme to version 4.0.2 or a newer patched version.