The Theme Demo Import plugin version 1.1.3 or earlier fails to validate the MIME type of files uploaded through its demo‑content import feature. Because the code that checks file types in WordPress is disabled, an administrator (or any other user with admin rights on a multisite) can upload an executable PHP file to the blog’s uploads directory. Once uploaded, the file can be accessed through the web server and executed, giving the attacker full remote code execution on the site, with the same privileges as the web server user flaw is a classic arbitrary file upload vulnerability (CWE‑434) that exposes the site to complete compromise.

This issue affects any WordPress site that has the Theme Demo Import plugin installed in a version up to and including 1.1.3. Both single‑site installations and multisite networks are impacted. The vulnerability is exploitable by any user who has administrator privileges, which includes non‑super‑admin site administrators on a multisite network.

The EPSS score is less than 1 %, suggesting that active exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. With a CVSS score of 7.2, the vulnerability is considered high severity. Nevertheless, because the flaw allows remote code execution and can be triggered by an account that normally exists on a site, the risk remains high. An attacker can simply use the import interface as an admin, upload a crafted PHP file, and then visit the file’s URL to run malicious code. No additional software exploitation steps are needed beyond logging into the site as an administrator.