CVE-2025-2525: 
WordPress vulnerability analysis and mitigation

CVE-2025-2525 affects the Streamit theme for WordPress, discovered and disclosed on April 7, 2025. The vulnerability exists in all versions up to and including 4.0.1, allowing authenticated attackers with subscriber-level permissions or higher to upload arbitrary files due to missing file type validation in the 'st_Authentication_Controller::edit_profile' function (NVD).

The vulnerability stems from insufficient file type validation in the 'st_Authentication_Controller::edit_profile' function. It has been assigned a CVSS v3.1 base score of 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD, Wordfence).

The vulnerability allows authenticated attackers with subscriber-level permissions or higher to upload arbitrary files to the affected site's server. This capability could potentially lead to remote code execution, significantly compromising the security of affected WordPress installations (NVD).

The vulnerability requires an authenticated user with at least subscriber-level permissions to exploit. The attack can be executed remotely with low attack complexity, as indicated by the CVSS metrics (NVD).

The vulnerability was addressed in version 4.0.2 released on March 21, 2025, with security improvements. Users are advised to update to the latest version of the Streamit theme (Streamit Changelog).