PT-2022-13185 · WordPress · Catch Themes Demo Import

Qerogram · Published 2022-03-07 · Updated 2022-04-12 · CVE-2022-0440

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Catch Themes Demo Import WordPress plugin versions prior to 2.1.1

Description The issue allows high privilege admins to upload arbitrary PHP files, potentially leading to remote code execution (RCE), even when the blog is hardened with constants such as DISALLOW UNFILTERED HTML, DISALLOW FILE EDIT, and DISALLOW FILE MODS set to true.

Recommendations For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. As a temporary workaround, consider restricting file upload capabilities to prevent potential exploitation.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-0440

Affected Products

Catch Themes Demo Import

References · 3

• 🔥 https://wpscan.com/vulnerability/2239095f-8a66-4a5d-ab49-1662a40fddf1 · Exploit
• https://osv.dev/vulnerability/CVE-2022-0440 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0440 · Security Note