Executive brief
The Everest Toolkit plugin for WordPress, which is used to help set up and manage website themes, contains a security flaw in its demo content import feature. This vulnerability allows a user with administrative privileges to upload malicious files, such as PHP scripts, directly to the web server. If exploited, an attacker could take full control of the website, potentially leading to data theft, site defacement, or the installation of further malware.
Technical details
An arbitrary file upload vulnerability exists in the Everest Toolkit plugin through version 1.2.3 due to the disabling of WordPress's default file-type validation during the demo-content import process. The flaw is located in the 'ET_import_demo_data' action within the demo-importer module. An authenticated attacker with 'Administrator' privileges (or the 'import' capability) can bypass security checks to upload a PHP shell to the '/wp-content/uploads/' directory. Successful exploitation results in Remote Code Execution (RCE) on the underlying web server. As of the advisory date, no patch has been released.
Affected products
- Everest Themes Everest Toolkit <= 1.2.3
Timeline
- 2026-07-10: other: Vulnerability added to WPScan database
- 2026-07-17: disclosed: Publicly published by WPScan
- 2026-08-01: advisory: NVD publication date