CVE-2021-39352

high-risk
Published 2021-10-21

The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution.

Do I need to act?

!
75.6% chance of exploitation in next 30 days
EPSS score — higher than 24% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.2/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Catchplugins

References (14)

Exploit http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1...
Third Party Advisory http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-S...
Exploit https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Imp...
Exploit https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352
Patch https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/tr...
Exploit https://www.exploit-db.com/exploits/50580
Third Party Advisory https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352
Exploit http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1...
Third Party Advisory http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-S...
Exploit https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Imp...
Exploit https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352
Patch https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/tr...
Exploit https://www.exploit-db.com/exploits/50580
Third Party Advisory https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352
51
/ 100
high-risk
Severity 26/34 · High
Exploitability 20/34 · Moderate
Exposure 5/34 · Minimal