CVE-2021-39352
Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload
- State
- Published
- Severity
- 7.2 High
- Published
- Oct 21, 2021
- Updated
- Feb 14, 2025
- Reserved
- Aug 20, 2021
Description
The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | Wordfence |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
Catch Themes Demo ImportCatch Themes Demo Import |
|
References
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352
- https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php
- https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md
- http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html
- http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html
- https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352
- https://www.exploit-db.com/exploits/50580
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.