CVE-2021-39352

🗓️ 21 Oct 2021 19:38:41Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 109 Views🌐 WEB

The Catch Themes Demo Import WordPress plugin allows arbitrary file uploads via import functionality, enabling remote code execution

Reporter	Title	Published	Views	Family All 16
0day.today	Wordpress Catch Themes Demo Import 1.6.1 Plugin- Remote Code Execution Exploit	9 Dec 202100:00	–	zdt
Circl	CVE-2021-39352	22 Oct 202100:37	–	circl
CNNVD	WordPress 代码问题漏洞	21 Oct 202100:00	–	cnnvd
CNVD	WordPress code issue vulnerability (CNVD-2021-83670)	25 Oct 202100:00	–	cnvd
Cvelist	CVE-2021-39352 Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload	21 Oct 202119:38	–	cvelist
Exploit DB	Wordpress Plugin Catch Themes Demo Import 1.6.1 - Remote Code Execution (RCE) (Authenticated)	9 Dec 202100:00	–	exploitdb
Metasploit	Wordpress Plugin Catch Themes Demo Import RCE	5 Jan 202217:42	–	metasploit
NVD	CVE-2021-39352	21 Oct 202120:15	–	nvd
OSV	CVE-2021-39352	21 Oct 202120:15	–	osv
Packet Storm	WordPress Catch Themes Demo Import 1.6.1 Shell Upload	9 Dec 202100:00	–	packetstorm

NVD

Vulners

Node

catchplugins catch_themes_demo_importRange≤1.7wordpress

[
  {
    "product": "Catch Themes Demo Import",
    "vendor": "Catch Themes Demo Import",
    "versions": [
      {
        "lessThanOrEqual": "1.7",
        "status": "affected",
        "version": "1.7",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html
wordfence	www.wordfence.com/vulnerability-advisories/
packetstormsecurity	www.packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html
plugins	www.plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php
github	www.github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352
github	www.github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md
exploit-db	www.exploit-db.com/exploits/50580

Parameter	Position	Path	Description	CWE
action	multipart/form-data	wp-admin/admin-ajax.php	Authenticated arbitrary file upload via the Catch Themes Demo Import import (admin-ajax) with a crafted content_file payload leading to RCE.	CWE-434
security	multipart/form-data	wp-admin/admin-ajax.php	Authenticated arbitrary file upload via the Catch Themes Demo Import import (admin-ajax) with a crafted content_file payload leading to RCE.	CWE-434
selected	multipart/form-data	wp-admin/admin-ajax.php	Authenticated arbitrary file upload via the Catch Themes Demo Import import (admin-ajax) with a crafted content_file payload leading to RCE.	CWE-434
content_file	multipart/form-data	wp-admin/admin-ajax.php	Authenticated arbitrary file upload via the Catch Themes Demo Import import (admin-ajax) with a crafted content_file payload leading to RCE.	CWE-434

17 Jun 2026 04:03Current

7.4High risk

Vulners AI Score7.4

CVSS 26.5

CVSS 3.17.2

EPSS0.55729

SSVC

CWE-434