An authenticated remote code execution vulnerability in the Theme Demo Import WordPress plugin allows high-privilege users to gain full server control.

This vulnerability involves the unrestricted upload of files with dangerous types. The plugin disables WordPress file-type validation, allowing authenticated administrators to upload malicious PHP files.

The CVSS score of 7.2 reflects the requirement for high-level authentication, yet the impact is severe. If an attacker gains access to an administrator account, this vulnerability allows them to execute arbitrary code on the underlying server, potentially leading to full site compromise, data theft, or persistence via backdoors.

Immediate Action: Update the Theme Demo Import plugin to the latest available version if a patch has been released, or uninstall the plugin if it is not strictly required for site functionality.

Proactive Monitoring: Audit WordPress user accounts to ensure no unauthorized accounts possess administrative privileges and monitor file system changes in the uploads directory.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests that attempt to upload non-standard file types or executable scripts to the media library.

Public Exploit Available: False

This vulnerability highlights the risk of plugins that bypass core security controls. Administrators should review their installed plugins and apply updates immediately. Furthermore, restrict administrative access to only necessary personnel to minimize the risk of a malicious or compromised account exploiting this flaw.