blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-0440

HIGH 7.2 CVSS 3.1
Published
March 7, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-434
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog (ie DISALLOW_UNFILTERED_HTML, DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS constants set to true)

Affected WordPress components

  • Catch Themes Demo Import Plugin · catch-themes-demo-import
    Confirmed match Active
    From 2.1.1 (including) to 2.1.1 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Catch Themes Demo Import — From 2.1.1 (including) to 2.1.1 (excluding)
  • catchplugins catch_themes_demo_import — Before 2.1.1

References

  • wpscan.com https://wpscan.com/vulnerability/2239095f-8a66-4a5d-ab49-1662a40fddf1 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record