CVE-2021-39352 Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload
Administrators can upload malicious files via the import feature, leading to remote code execution on the WordPress site.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-39352?
CVE-2021-39352 is a high-severity vulnerability in Catch Themes Demo Import, published on 21 Oct 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution.
Weakness: CWE-434
Which versions are affected by CVE-2021-39352?
It affects 1 product.
Products include Catchplugins Catch Themes Demo Import.
How do I fix CVE-2021-39352?
No fix has been published for CVE-2021-39352 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-39352 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-39352 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Catch Themes Demo Import
Sources
Also known as GHSA-p6rq-prcm-f9fw.