CVE-2026-13157

CVE-2026-13157 Theme Demo Import false during upload processing. An authenticated user possessing import capabilities—such as a default site administrator or a non-super-admin site administrator in a WordPress Multisite architecture—can bypass file restriction enforcement to upload arbitrary...

Exploit for CVE-2026-13157

CVE-2026-13157 Theme Demo Import...

WordPress Theme Demo Import plugin <= 1.1.3 - Admin+ Arbitrary File Upload vulnerability

Admin+ Arbitrary File Upload vulnerability discovered by Huynh Kien Minh in WordPress Plugin Theme Demo Import versions = 1.1.3...

CVE-2026-13157

The Theme Demo Import WordPress plugin (versions false override in $upload_overrides. This allows high-privilege users, such as default site administrators or non-super-admin site administrators in a Multisite architecture, to bypass restrictions and upload executable PHP scripts (e.g., .php, .p...

CVE-2022-1538

The connected data confirms CVE-2022-1538 affects the WordPress Theme Demo Importer plugin prior to 1.1.1. The root cause is a lack of validation of imported files, enabling high-privilege users (e.g., admin) to upload arbitrary files such as PHP even when FILE_MODS and FILE_EDIT are disallowed. ...

CVE-2022-1538 Theme-Demo-Importer < 1.1.1 - Admin+ Arbitrary File Upload

Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files such as PHP even when FILEMODS and FILEEDIT are disallowed...

PT-2024-11509

Name of the Vulnerable Software and Affected Versions Theme Demo Import WordPress plugin versions prior to 1.1.1 Description The issue allows high-privilege users, such as admins, to upload arbitrary files, including PHP files, even when FILE MODS and FILE EDIT are disallowed, due to a lack of...

CVE-2022-1538: Unrestricted Upload of File with Dangerous Type

Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files such as PHP even when FILEMODS and FILEEDIT are disallowed...

CVE-2023-28170

Unrestricted Upload of File with Dangerous Type vulnerability in Themely Theme Demo Import.This issue affects Theme Demo Import: from n/a through 1.1.1...

CVE-2023-28170

Unrestricted Upload of File with Dangerous Type vulnerability in Themely Theme Demo Import.This issue affects Theme Demo Import: from n/a through 1.1.1...

Unrestricted file upload

Unrestricted Upload of File with Dangerous Type vulnerability in Themely Theme Demo Import.This issue affects Theme Demo Import: from n/a through 1.1.1...

CVE-2023-28170 WordPress Theme Demo Import Plugin <= 1.1.1 is vulnerable to Arbitrary File Upload

Unrestricted Upload of File with Dangerous Type vulnerability in Themely Theme Demo Import.This issue affects Theme Demo Import: from n/a through 1.1.1...

WordPress Plugin Theme Demo Import Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists in...

CVE-2023-28170: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in Themely Theme Demo Import.This issue affects Theme Demo Import: from n/a through 1.1.1...

PT-2023-21606

Name of the Vulnerable Software and Affected Versions Theme Demo Import versions 1.1.1 and earlier Description The issue is related to an Unrestricted Upload of File with Dangerous Type vulnerability in Themely Theme Demo Import. This allows for the upload of files with potentially dangerous type...

WordPress Theme Demo Import Plugin <= 1.1.3 is vulnerable to Arbitrary File Upload

Software Theme Demo Import Type Plugin Vulnerable versions = 1.1.3 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-28170 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 5560e6fed5b7 Credits deokhunKim Required privilege Administrat...