CVE-2022-0440CWE-434

Catch Themes Demo Import < 2.1.1 - Admin+ Remote Code Execution

published March 7, 2022

CVSS
—
EPSS
1%
Percentile
73.0
In the wild
Unconfirmed
What it is

The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog (ie DISALLOW_UNFILTERED_HTML, DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS constants set to true)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01442 · 73.0th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2022-03-07T08:16Z
EPSS history
Timeline
  • 07 MAR 08:16Z
    Catch Themes Demo Import < 2.1.1 - Admin+ Remote Code Execution
    cvelistv5