CVE-2022-0440 Catch Themes Demo Import < 2.1.1 - Admin+ Remote Code Execution

2022-03-0708:16:42

CWE-434

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

42.9%

JSON

The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog (ie DISALLOW_UNFILTERED_HTML, DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS constants set to true)

CNA Affected

[
  {
    "product": "Catch Themes Demo Import",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.1.1",
        "status": "affected",
        "version": "2.1.1",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/2239095f-8a66-4a5d-ab49-1662a40fddf1

0.001 Low

EPSS

Percentile

42.9%

JSON

Related for CVELIST:CVE-2022-0440