Postmagthemes Demo Import Vulnerabilities

The PostmagThemes Demo Import plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with administrator-level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execut...

CVSS:

7.2

Affected:

up to 1.0.7

Fixed in:

1.0.8

Disclosed:

Nov 11, 2022

CVE-2022-1540 on NVD →

The PostmagThemes Demo Import plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.0.6. This is due to insufficient file type validation on imported files that makes it possible for high-level authenticated users, such as administrators, to upload arbitrary files onto a vulne...

CVSS:

7.2

Affected:

up to 1.0.6

Fixed in:

1.0.7

Disclosed:

Aug 5, 2022