Executive brief
The Theme Demo Import plugin for WordPress, which helps site owners import sample content, contains a security flaw that allows high-privileged users to upload malicious files. An attacker with administrative access could use this to upload and run executable code on the server. This could lead to a complete takeover of the website and its underlying data.
Technical details
The Theme Demo Import plugin fails to validate file extensions or MIME types during the demo-content import process because the standard WordPress file-type check is explicitly disabled. This vulnerability is located in the 'TDI_import_demo_data' AJAX action. An authenticated attacker with 'Administrator' privileges (or any role with 'import' capabilities) can bypass security restrictions to upload executable PHP scripts to the WordPress uploads directory. By accessing the uploaded file directly, the attacker can achieve remote code execution (RCE) on the server. As of the advisory date, no patch is available.
Affected products
- Unknown Theme Demo Import <= 1.1.3
Timeline
- 2026-07-10: other: Vulnerability added to WPScan database
- 2026-07-17: disclosed: Public disclosure by WPScan
- 2026-08-01: advisory: NVD publication date