The Catch Themes Demo Import plugin for WordPress contains a missing authorization flaw in its activate_plugin routine. When an authenticated user submits a GET request that includes the activate_plugin parameter, the function catch_themes_demo_import_activate_plugin() calls Plugin_Upgrader::install() to download and install a hardcoded "essential-content-types" plugin before checking the user’s capability with current_user_can('activate_plugins'). This means any authenticated user with subscriber-level access or higher can trigger the flaw and install the plugin without properly authorized permission. The weakness is a classic CWE‑862 Missing Authorization.

This vulnerability applies to all releases of the Catch Themes Demo Import plugin from Catch Plugins up to and including version 3.3. WordPress sites that have installed any of these vulnerable versions are at risk, while versions newer than 3.3 contain the required authorization check and are not affected.

The CVSS base score of 4.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker who can authenticate to the WordPress admin interface as a subscriber or higher role can trigger the flaw by sending a crafted request containing the activate_plugin GET parameter to the admin area. The attacker can then install the specific "essential-content-types" plugin, compromising the site’s integrity. The attack vector is authenticated, exploiting missing authorization on a user with subscriber-level access or above.