The Streamit WordPress theme contains a flaw in the edit_profile routine where file type validation is omitted. Authenticated users with subscriber or higher privileges can upload any file to the server. An attacker could upload a PHP or other executable file and later access it through the web to run arbitrary code, thereby enabling remote code execution on the host.

The affected product is the iqonicdesign Streamit WordPress theme. All released versions up to and including 4.0.1 are impacted. Users running Streamit 4.0.1 or earlier should upgrade to a newer release as soon as possible.

The CVSS base score of 8.8 indicates a high severity vulnerability, and the EPSS score around 1% suggests a low but non‑zero chance of exploitation. Because the attack requires authenticated subscriber‑level access, attackers must first compromise or impersonate a legitimate user. Once a malicious file is uploaded, the absence of MIME type checks allows the attacker to serve it via the web, potentially leading to code execution or data exposure. The vulnerability is not listed in CISA’s KEV catalog.