CVE-2022-0440: Catch Themes Demo Import < 2.1.1 - Admin+ Remote Code Execution

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-07 · updated 2026-06-17
Weakness: CWE-434

Description

The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog (ie DISALLOW_UNFILTERED_HTML, DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS constants set to true)

Affected products

Catch Themes Demo Import: before 2.1.1 — fixed in 2.1.1

How to fix

Upgrade to a fixed version: Catch Themes Demo Import 2.1.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/2239095f-8a66-4a5d-ab49-1662a40fddf1
https://wpscan.com/vulnerability/2239095f-8a66-4a5d-ab49-1662a40fddf1

Get alerted when CVE-2022-0440 or the next vulnerability affects your stack