blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-39352

HIGH 7.2 CVSS 3.1
Published
October 21, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@wordfence.com
Weakness
CWE-434
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution.

Affected WordPress components

  • Catch Themes Demo Import Plugin · catch-themes-demo-import
    Confirmed match Active
    From 1.7 (including) to 1.7 (including)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Catch Themes Demo Import Catch Themes Demo Import — From 1.7 (including) to 1.7 (including)
  • catchplugins catch_themes_demo_import — Up to and including 1.7

References

  • packetstormsecurity.com http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html Exploit, Third Party Advisory, VDB Entry
  • packetstormsecurity.com http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html Third Party Advisory, VDB Entry
  • github.com https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md Exploit, Third Party Advisory
  • github.com https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352 Exploit, Third Party Advisory
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php Patch, Third Party Advisory
  • www.exploit-db.com https://www.exploit-db.com/exploits/50580 Exploit, Third Party Advisory, VDB Entry
  • www.wordfence.com https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352 Third Party Advisory
  • nvd.nist.gov Official NVD record