Description
WordPress Plugin Theme Editor is prone to a vulnerability that lets attackers download arbitrary files because the application fails to sufficiently verify user-supplied input. This may allow an attacker to gain access to sensitive information, which may aid in launching further attacks. WordPress Plugin Theme Editor version 2.5 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 2.6 or latest
References
https://wpscan.com/vulnerability/566c6836-fc3d-4dd9-b351-c3d9da9ec22e
https://plugins.svn.wordpress.org/theme-editor/trunk/readme.txt
Related Vulnerabilities
Jboss EAP Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2019-0205)
PHP Use of Externally-Controlled Format String Vulnerability (CVE-2011-1153)
Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2018-16854)
MySQL CVE-2018-2839 Vulnerability (CVE-2018-2839)
OpenSSL Use of a Broken or Risky Cryptographic Algorithm Vulnerability (CVE-2005-2946)