Unauthenticated Backup File Download in WordPress Cherry Framework

WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download_backup.php endpoint. Attackers can directly access the download_backup.php script in the admin/data_management directory to obtain ZIP archives containing the entire wp-content/themes directory contents.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2018-25437 is an authentication bypass vulnerability affecting WordPress CherryFramework themes version 3.1.4 and earlier. The flaw allows unauthenticated attackers to directly access the download_backup.php script without credentials, enabling them to download sensitive backup files containing the entire wp-content/themes directory. This is particularly critical because backup archives often contain hardcoded credentials, database configurations, API keys, and other sensitive data that can serve as stepping stones for further compromise. WordPress sites using affected CherryFramework themes are immediately at risk, as the vulnerability requires no authentication, no user interaction, and no complex exploitation techniques—making it trivially exploitable at scale.

Casky's 261 matching skills, powered by Claude AI's extended reasoning capabilities, detect the attack patterns underlying this vulnerability across two key MITRE ATT&CK tactics: Initial Access (TA0004) and Credential Access (TA0006). Practitioners using Casky would identify suspicious patterns such as unauthenticated requests to admin-level endpoints, unusual downloads of large ZIP archives from web-accessible directories, and access to backup or data management scripts by non-admin users. The platform's skill mapping would surface that attackers exploiting this CVE are performing reconnaissance for sensitive configuration files and credentials—classic precursors to post-exploitation activities. Your findings would highlight the combination of missing authentication checks on administrative functions and improper access controls, enabling your team to prioritize remediation and implement compensating controls like IP whitelisting or WAF rules blocking access to admin/data_management paths before patching becomes possible.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2018-25437.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2018-25437

Casky has 261 skills that investigate the attack patterns behind CVE-2018-25437. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn