Description

The Streamit theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'st_Authentication_Controller::edit_profile' function in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Classification

CVE ID: CVE-2025-2525

CVSS Base Severity: HIGH

CVSS Base Score: 8.8

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor: iqonicdesign

Product: Streamit

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.32% (probability of being exploited)

EPSS Percentile: 53.85% (scored less or equal to compared to others)

EPSS Date: 2025-04-20 (when was this score calculated)

References

https://nvd.nist.gov/vuln/detail/CVE-2025-2525
https://www.wordfence.com/threat-intel/vulnerabilities/id/83a58119-d0ed-47fe-93d1-1aa1def2cf44?source=cve
https://themeforest.net/item/streamit-video-streaming-wordpress-theme/29772881
https://documentation.iqonic.design/streamit/change-log/streamit-v4-0/

Timeline