Catch Themes Demo Import < 2.1.1 - Admin+ Remote Code Execution
Priority LOW 35CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.
Summary
The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog (ie DISALLOW_UNFILTERED_HTML, DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS constants set to true)
Why it matters now
EPSS 0.01442 73rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Catch Themes Demo Import (Unknown): 2.1.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Catch Themes Demo Import | 2.1.1 to before 2.1.1 | 2.1.1 | Patch available | CNA |
- Catch Themes Demo Import VendorUnknown Affected 2.1.1 to before 2.1.1 Fixed in 2.1.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:catchplugins:catch_themes_demo_import:*:*:*:*:*:wordpress:*:* | before 2.1.1 | Vulnerable | Catch Plugins |
- cpe:2.3:a:catchplugins:catch_themes_demo_import:*:*:*:*:*:wordpress:*:* Versions before 2.1.1 Vulnerable ·Catch Plugins
Remediation
- Fix · CNA Catch Themes Demo Import (Unknown) Fixed in 2.1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0440
- 2026-10-03 Alias added: GHSA-8h3q-6j29-4729
References
More Catch Plugins Catch Themes Demo Import vulnerabilities
- TI-2021-16719 Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload CVSS 3.1HIGH 7.2
- TI-2021-07034 Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change CVSS 3.1MEDIUM 5.7
Sources
- CVE-2022-0440 · CVE Program
- CVE-2022-0440 · NVD
- FIRST EPSS
- GHSA-8h3q-6j29-4729 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences