CVE-2021-39352 - Vulnerability Details - OpenCVE

The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.7776.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Catchplugins	Catch Themes Demo Import

Configuration 1 [-]

cpe:2.3:a:catchplugins:catch_themes_demo_import:*:*:*:*:*:wordpress:*:*

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

Update to version 1.7 or newer.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html
http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html
https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md
https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352
https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php
https://www.exploit-db.com/exploits/50580
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352

History

Fri, 14 Feb 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2021-10-21T19:38:41.649Z

Updated: 2025-02-14T17:54:38.315Z

Reserved: 2021-08-20T00:00:00.000Z

Link: CVE-2021-39352

Vulnrichment

Updated: 2024-08-04T02:06:42.231Z

NVD

Status : Modified

Published: 2021-10-21T20:15:08.060

Modified: 2024-11-21T06:19:23.133

Link: CVE-2021-39352

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Catch Themes Demo Import", "vendor": "Catch Themes Demo Import", "versions": [{"lessThanOrEqual": "1.7", "status": "affected", "version": "1.7", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Thinkland Security Team"}], "datePublic": "2021-10-21T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-02-07T19:23:47.000Z", "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352"}, {"tags": ["x_refsource_MISC"], "url": "https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352"}, {"tags": ["x_refsource_MISC"], "url": "https://www.exploit-db.com/exploits/50580"}], "solutions": [{"lang": "en", "value": "Update to version 1.7 or newer."}], "source": {"discovery": "EXTERNAL"}, "title": "Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "Wordfence", "ASSIGNER": "security@wordfence.com", "DATE_PUBLIC": "2021-10-21T16:05:00.000Z", "ID": "CVE-2021-39352", "STATE": "PUBLIC", "TITLE": "Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Catch Themes Demo Import", "version": {"version_data": [{"version_affected": "<=", "version_name": "1.7", "version_value": "1.7"}]}}]}, "vendor_name": "Catch Themes Demo Import"}]}}, "credit": [{"lang": "eng", "value": "Thinkland Security Team"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}]}, "references": {"reference_data": [{"name": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352", "refsource": "MISC", "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352"}, {"name": "https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php", "refsource": "MISC", "url": "https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php"}, {"name": "https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md", "refsource": "MISC", "url": "https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md"}, {"name": "http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html"}, {"name": "http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html"}, {"name": "https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352", "refsource": "MISC", "url": "https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352"}, {"name": "https://www.exploit-db.com/exploits/50580", "refsource": "MISC", "url": "https://www.exploit-db.com/exploits/50580"}]}, "solution": [{"lang": "en", "value": "Update to version 1.7 or newer."}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T02:06:42.231Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.exploit-db.com/exploits/50580"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-14T17:54:22.717837Z", "id": "CVE-2021-39352", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-14T17:54:38.315Z"}}]}, "cveMetadata": {"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "assignerShortName": "Wordfence", "cveId": "CVE-2021-39352", "datePublished": "2021-10-21T19:38:41.649Z", "dateReserved": "2021-08-20T00:00:00.000Z", "dateUpdated": "2025-02-14T17:54:38.315Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://www.exploit-db.com/exploits/50580", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T02:06:42.231Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-39352", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-14T17:54:22.717837Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-14T17:54:15.353Z"}}], "cna": {"title": "Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "value": "Thinkland Security Team"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Catch Themes Demo Import", "product": "Catch Themes Demo Import", "versions": [{"status": "affected", "version": "1.7", "versionType": "custom", "lessThanOrEqual": "1.7"}]}], "solutions": [{"lang": "en", "value": "Update to version 1.7 or newer."}], "datePublic": "2021-10-21T00:00:00.000Z", "references": [{"url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352", "tags": ["x_refsource_MISC"]}, {"url": "https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md", "tags": ["x_refsource_MISC"]}, {"url": "http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html", "tags": ["x_refsource_MISC"]}, {"url": "http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352", "tags": ["x_refsource_MISC"]}, {"url": "https://www.exploit-db.com/exploits/50580", "tags": ["x_refsource_MISC"]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2022-02-07T19:23:47.000Z"}, "x_legacyV4Record": {"credit": [{"lang": "eng", "value": "Thinkland Security Team"}], "impact": {"cvss": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, "source": {"discovery": "EXTERNAL"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_name": "1.7", "version_value": "1.7", "version_affected": "<="}]}, "product_name": "Catch Themes Demo Import"}]}, "vendor_name": "Catch Themes Demo Import"}]}}, "solution": [{"lang": "en", "value": "Update to version 1.7 or newer."}], "data_type": "CVE", "generator": {"engine": "Vulnogram 0.0.9"}, "references": {"reference_data": [{"url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352", "name": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352", "refsource": "MISC"}, {"url": "https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php", "name": "https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php", "refsource": "MISC"}, {"url": "https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md", "name": "https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md", "refsource": "MISC"}, {"url": "http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html", "name": "http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html", "refsource": "MISC"}, {"url": "http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html", "name": "http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html", "refsource": "MISC"}, {"url": "https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352", "name": "https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352", "refsource": "MISC"}, {"url": "https://www.exploit-db.com/exploits/50580", "name": "https://www.exploit-db.com/exploits/50580", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-39352", "AKA": "Wordfence", "STATE": "PUBLIC", "TITLE": "Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload", "ASSIGNER": "security@wordfence.com", "DATE_PUBLIC": "2021-10-21T16:05:00.000Z"}}}}, "cveMetadata": {"cveId": "CVE-2021-39352", "state": "PUBLISHED", "dateUpdated": "2025-02-14T17:54:38.315Z", "dateReserved": "2021-08-20T00:00:00.000Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2021-10-21T19:38:41.649Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:catchplugins:catch_themes_demo_import:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "20DC7E5C-982B-40B5-A83E-90A93FF16CEC", "versionEndIncluding": "1.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution."}, {"lang": "es", "value": "El plugin Catch Themes Demo Import de WordPress es vulnerable a una carga de archivos arbitrarios por medio de la funcionalidad import que se encuentra en el archivo ~/inc/CatchThemesDemoImport.php, en versiones hasta la 1.7 incluy\u00e9ndola, debido a una comprobaci\u00f3n insuficiente del tipo de archivo. Esto hace posible que un atacante con privilegios administrativos cargue archivos maliciosos que pueden ser usados para lograr una ejecuci\u00f3n de c\u00f3digo remota"}], "id": "CVE-2021-39352", "lastModified": "2024-11-21T06:19:23.133", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-10-21T20:15:08.060", "references": [{"source": "security@wordfence.com", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html"}, {"source": "security@wordfence.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md"}, {"source": "security@wordfence.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352"}, {"source": "security@wordfence.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php"}, {"source": "security@wordfence.com", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/50580"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://www.exploit-db.com/exploits/50580"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Secondary"}]}