CVE-2022-1540 PostmagThemes Demo <= 1.0.7 - Admin+ Arbitrary File Upload
Admins can upload arbitrary files, including PHP, leading to remote code execution in the PostmagThemes Demo Import plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1540?
CVE-2022-1540 is a high-severity vulnerability in Unknown PostmagThemes Demo Import, published on 5 Dec 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) leading to RCE.
Which versions are affected by CVE-2022-1540?
It affects 1 product.
Products include Postmagthemes Postmagthemes Demo Import.
How do I fix CVE-2022-1540?
No fix has been published for CVE-2022-1540 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-1540 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-1540 exists.
Sources
Also known as GHSA-wpw9-595f-g34r.