CVE-2020-36333: Missing Authentication for Critical Function

themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a resetwizardactions hook...

CVE-2020-36334: Cross-Site Request Forgery (CSRF)

themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database...

PT-2021-12012

Name of the Vulnerable Software and Affected Versions: themegrill-demo-importer versions prior to 1.6.3 Description: The issue allows for Cross-Site Request Forgery CSRF attacks, which can be used to wipe the database, as demonstrated by a specific proof-of-concept attack. Recommendations: For...

WordPress plugin cross-site request forgeing vulnerability

WordPress Plugin is an open source application plugin for WordPress. The WordPress plugin themegrill-demo-importer version prior to 1.6.3 suffers from a cross-site request forgery vulnerability, as demonstrated by clearing the database...

WordPress ThemeGrill Demo Importer plugin <= 1.6.2 - Bypass and Database Wipe vulnerability

Bypass and Database Wipe vulnerability discovered by Dave Patchstack in WordPress ThemeGrill Demo Importer plugin versions = 1.6.2. Solution Update the WordPress ThemeGrill Demo Importer plugin to the latest available version at least 1.6.3...

WordPress ThemeGrill Plugin Privilege Escalation (CVE-2020-7047; CVE-2020-7048)

A privilege escalation exists in WordPress ThemeGrill plugin. Successful exploitation of this vulnerability would allow a remote attacker to gain unauthorized access to the affected system...

WordPress Plugin 'ThemeGrill Demo Importer' 1.3.4 < 1.6.3 Database Wipe and Auth Bypass

The WordPress application running on the remote host has the 'ThemeGrill Demo Importer' plugin that is 1.3.4 or later, but prior to 1.6.3. It is, therefore, vulnerable to an missing authentication check that allows an unauthenticated user to wipe the entire database to its default state and then...

ThemeGrill Demo Importer Plugin for WordPress < 1.6.2 Database Wipe and Authentication Bypass

The WordPress ThemeGrill Demo Importer Plugin installed on the remote host is affected by a database wipe and authentication bypass vulnerability due to improper access controls. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported...

WordPress ThemeGrill Demo Importer Plugin 1.3.4 < 1.6.3 Authentication Bypass and Database Wipe Vulnerability

The WordPress plugin Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

Active Exploits Hit Vulnerable WordPress ThemeGrill Plugin

Researchers are urging users of a vulnerable WordPress plugin, ThemeGrill Demo Importer, to update as soon as possible after discovering attackers are actively exploiting a flaw in the plugin. The ThemeGrill Demo Importer plugin is owned by ThemeGrill, which offers various templates for website...

Critical Bug in WordPress Theme Plugin Opens 200,000 Sites to Hackers

A popular WordPress theme plugin with over 200,000 active installations contains a severe but easy-to-exploit software vulnerability that, if left unpatched, could let unauthenticated remote attackers compromise a wide range of websites and blogs. The vulnerable plugin in question is 'ThemeGrill...

Critical Bug in WordPress Theme Plugin Opens 200,000 Sites to Hackers

A popular WordPress theme plugin with over 200,000 active installations contains a severe but easy-to-exploit software vulnerability that, if left unpatched, could let unauthenticated remote attackers compromise a wide range of websites and blogs. The vulnerable plugin in question is 'ThemeGrill...

VulnCheck KEV: CVE-2020-36333

themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a resetwizardactions hook...

ThemeGrill Demo Importer < 1.6.3 - Auth Bypass & Database Wipe

There is a vulnerability that allows any unauthenticated user to wipe the entire database to its default state after which they are automatically logged in as an administrator. Edit WPScanTeam: v1.6.2 was released with an insufficient fix, allowing attackers to still exploit the issue using a CSR...

ThemeGrill Demo Importer < 1.6.3 - Auth Bypass & Database Wipe

There is a vulnerability that allows any unauthenticated user to wipe the entire database to its default state after which they are automatically logged in as an administrator. Edit WPScanTeam: v1.6.2 was released with an insufficient fix, allowing attackers to still exploit the issue using a CSR...