Streamit Vulnerabilities & Security Issues

Streamit <= 4.5.0 - Unauthenticated Remote Code Execution

critical

The Streamit theme for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.5.0. This makes it possible for unauthenticated attackers to execute code on the server.

CVSS:: 9.8
Affected:: up to 4.5.0
Fix:: No patched version reported
Disclosed:: Jul 8, 2026

CVE-2026-13423 on NVD →

Streamit <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover

high

The Streamit theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like email in the 'st_Authentication_Controller::edit_profile' function. This makes...

CVSS:: 8.8
Affected:: up to 4.0.2
Fixed in:: 4.0.3
Disclosed:: Apr 7, 2025

CVE-2025-2526 on NVD →

Streamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Upload

high

The Streamit theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'st_Authentication_Controller::edit_profile' function in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to uploa...

CVSS:: 8.8
Affected:: up to 4.0.1
Fixed in:: 4.0.2
Disclosed:: Apr 4, 2025

CVE-2025-2525 on NVD →

Streamit <= 4.0.1 - Authenticated (Subscriber+) Arbitrary File Download

medium

The Sreamit theme for WordPress is vulnerable to arbitrary file downloads in all versions up to, and including, 4.0.1. This is due to insufficient file validation in the 'st_send_download_file' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to download arbitrary fi...