Executive brief
CherryFramework, a theme framework for WordPress, contains a security flaw that allows anyone to download a full backup of the website's themes. An unauthenticated attacker can access a specific web link to trigger a download of a ZIP archive containing sensitive site files. This could lead to the exposure of proprietary code, configuration details, or other sensitive information stored within the themes directory.
Technical details
A missing authentication vulnerability (CWE-306) exists in the CherryFramework theme for WordPress version 3.1.4 and earlier. The vulnerability is located in the 'download_backup.php' script within the 'admin/data_management' directory. An unauthenticated remote attacker can directly access this endpoint via a simple GET request to trigger the generation and download of a ZIP archive. This archive contains the entire contents of the 'wp-content/themes' directory, potentially exposing sensitive source code and configuration data. The project is reportedly discontinued, and no official patch is available; users are advised to remove the vulnerable script or migrate to a supported framework.
Affected products
- CherryFramework CherryFramework Themes <= 3.1.4
Timeline
- 2018-11-17: disclosed: Initial discovery by researcher b1p0l4r
- 2018-11-21: other: Exploit published on Exploit-DB
- 2026-06-15: advisory: NVD/VulnCheck advisory published