CVE-2022-0440 - Catch Themes Demo Import < 2.1.1 - Admin+ Remote Code Execution · CoreCVE

Back Back to CVE browser

HIGH

Catch Themes Demo Import < 2.1.1 - Admin+ Remote Code Execution

Published Mar 7, 2022

7.2

HIGH

CVSS 3.1

EPSS 1.44%

Description

The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog (ie DISALLOW_UNFILTERED_HTML, DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS constants set to true)

Affected products

Vendor n/a Product Catch Themes Demo Import Default
n/a
- Version
  2.1.1
  Status
  affected
  Constraints
  <2.1.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Catch Themes Demo Import

n/a

Version	Status	Constraints
2.1.1	affected	<2.1.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (1)

https://wpscan.com/vulnerability/2239095f-8a66-4a5d-ab49-1662a40fddf1
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/2239095f-8a66-4a5d-ab49-1662a40fddf1		x_refsource_MISCExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Mar 7, 2022

Updated Aug 2, 2024

Reserved Feb 1, 2022

Link CVE-2022-0440

CISA Vulnrichment

Updated n/a

Status Modified

Modified Jun 17, 2026

Link CVE-2022-0440

Severity n/a

Public date n/a

Links CVE-2022-0440

Assigner n/a

Published n/a

Updated n/a

Exploited since n/a

Link n/a