by From WordPress.org
The Catch Themes Demo Import plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.3. This is due to the catch_themes_demo_import_activate_plugin() function, hooked on admin_init when the activate_plugin GET parameter is present, calling Plugin_Upgrader::install() to download and install a plugin from WordPress.org before performing the current_user_can('activate_plugins') capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to install the hardcoded 'essential-content-types' plugin from the WordPress.
CVSS Score
4.3
MEDIUM
Published
16 Jul 2026 04:17
Modified
17 Jul 2026 13:17
Vendor
From WordPress.org
Source
CIRCL
CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Complexity
Low
Privileges
Low
Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Weaknesses (CWE)
CWE-862
References
plugins.trac.wordpress.org
/browser/catch-themes-demo-import/tags/3.2/inc/demo-importer.php
plugins.trac.wordpress.org
/browser/catch-themes-demo-import/tags/3.2/inc/demo-importer.php
plugins.trac.wordpress.org
/browser/catch-themes-demo-import/tags/3.2/inc/demo-importer.php
plugins.trac.wordpress.org
/browser/catch-themes-demo-import/tags/3.2/inc/demo-importer.php
plugins.trac.wordpress.org
/browser/catch-themes-demo-import/tags/3.3/inc/demo-importer.php
plugins.trac.wordpress.org
/browser/catch-themes-demo-import/tags/3.3/inc/demo-importer.php
plugins.trac.wordpress.org
/browser/catch-themes-demo-import/tags/3.3/inc/demo-importer.php
plugins.trac.wordpress.org
/browser/catch-themes-demo-import/tags/3.3/inc/demo-importer.php
plugins.trac.wordpress.org
/changeset
www.wordfence.com
/threat-intel/vulnerabilities/id/12c7661c-0700-4370-9272-d8a19b17006e
Affected Systems
From WordPress.org
External Links
KEV Status
Not in CISA KEV catalog