The vulnerability is a Cross‑Site Request Forgery (CSRF) that allows an attacker to trigger the activation of the Di Themes Demo Site Importer plugin without the site administrator’s consent. This could enable the attacker to install and activate the plugin, potentially opening the door to additional exploitation if the activated plugin contains further flaws. The weakness mapped to CWE‑352 indicates the lack of proper anti‑CSRF mechanisms for the activation endpoint.

WordPress installations that have Di Themes Demo Site Importer version 1.2 or earlier. The affected vendor is Di Themes, and the product is the Demo Site Importer plugin. Any site whose WordPress environment includes that plugin in a version <=1.2 is vulnerable.

The CVSS score of 4.3 reflects moderate risk, but the EPSS score of <1% suggests that exploitation is currently considered unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack path requires a user to be authenticated as an administrator on the target site and then visit an attacker‑controlled page that submits a request to activate the plugin. Once activated, the plugin’s functionality could be leveraged for further attacks if other weaknesses exist.