The Streamit WordPress theme contains a CWE-22 path traversal vulnerability in the 'st_send_download_file' function, permitting authenticated users with subscriber or higher privileges to download arbitrary files from the server. This occurs because the theme does not properly restrict or validate file paths, enabling traversal outside intended directories. The vulnerability affects all versions up to and including 4.0.1. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges at the subscriber level, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability.

An attacker with subscriber-level access or higher can exploit this vulnerability to download arbitrary files from the server hosting the WordPress site using the Streamit theme. This can lead to unauthorized disclosure of sensitive information. There is no indication of impact on system integrity or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict subscriber-level access where possible and monitor for suspicious activity related to file downloads. Avoid granting unnecessary privileges to users. Follow updates from iqonicdesign for official fixes.