PT-2026-60403 · WordPress · Catch Themes Demo Import

Prism · Published 2026-07-16 · Updated 2026-07-16 · CVE-2026-15336

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Catch Themes Demo Import versions prior to 3.4

Description An authorization flaw exists where the catch themes demo import activate plugin() function, triggered during admin init when the activate plugin GET parameter is present, executes Plugin Upgrader::install() to download and install a plugin from WordPress.org before verifying if the user has the activate plugins capability. This allows authenticated users with subscriber-level access or higher to install the hardcoded 'essential-content-types' plugin.

Recommendations Update to version 3.4 or later. As a temporary mitigation, restrict access to the activate plugin parameter in the admin init process.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-15336

Affected Products

Catch Themes Demo Import

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-15336 · Security Note
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3604098%40catch-themes-demo-import&new=3604098%40catch-themes-demo-import · Note
• https://plugins.trac.wordpress.org/browser/catch-themes-demo-import/tags/3.2/inc/demo-importer.php#L235 · Note
• https://plugins.trac.wordpress.org/browser/catch-themes-demo-import/tags/3.3/inc/demo-importer.php#L235 · Note
• https://twitter.com/VulmonFeeds/status/2077628799336796610 · Twitter Post
• https://plugins.trac.wordpress.org/browser/catch-themes-demo-import/tags/3.2/inc/demo-importer.php#L233 · Note
• https://plugins.trac.wordpress.org/browser/catch-themes-demo-import/tags/3.3/inc/demo-importer.php#L136 · Note
• https://plugins.trac.wordpress.org/browser/catch-themes-demo-import/tags/3.2/inc/demo-importer.php#L136 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/12c7661c-0700-4370-9272-d8a19b17006e?source=cve · Note
• https://plugins.trac.wordpress.org/browser/catch-themes-demo-import/tags/3.2/inc/demo-importer.php#L135 · Note
• https://plugins.trac.wordpress.org/browser/catch-themes-demo-import/tags/3.3/inc/demo-importer.php#L135 · Note
• https://plugins.trac.wordpress.org/browser/catch-themes-demo-import/tags/3.3/inc/demo-importer.php#L233 · Note