CVE-2022-0440CWE-434

CVE-2022-0440: vulnerability in Catch Themes Demo Import

Catch Themes Demo Import < 2.1.1 - Admin+ Remote Code Execution

Published · Updated

Follow this CVE+ Monitor Catch Themes Demo Import

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.4%
The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog (ie DISALLOW_UNFILTERED_HTML, DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS constants set to true)
Affected products
Unknown · Catch Themes Demo Import