CVE-2026-13157

The CVE-2026-13157 entry concerns the Demo Import WordPress plugin up to version 1.1.3, where file-type validation is bypassed during demo-content import. This allows high-privilege users (Administrator by default, including non-super-admins on multisite) to upload executable PHP files to the upl...