CVE-2021-39352: Catch Themes Demo Import plugin arbitrary file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityThe flaw allows remote code execution, has public exploit code and a very high EPSS score, though it requires administrative privileges to exploit.

What it is

The Catch Themes Demo Import WordPress plugin, in versions up to and including 1.7, fails to properly validate file types in its import functionality within ~/inc/CatchThemesDemoImport.php. An authenticated administrator can upload malicious files through that import path. Because uploaded files can be executed, the flaw enables remote code execution on the affected site.

Impact

An attacker with administrative access gains the ability to upload and execute arbitrary files, leading to remote code execution and full compromise of the WordPress site.

Attack surface

The flaw is reached over the network through the plugin's demo import functionality. It requires an authenticated account with administrative privileges and no user interaction beyond the upload action.

Exploitation

The record is not listed in CISA KEV, but EPSS is high at 0.56259 (99th percentile) and multiple references are tagged Exploit, including Packet Storm, Exploit-DB and public GitHub PoCs.

What to do

• Update the Catch Themes Demo Import plugin to a version later than 1.7, applying the vendor patch referenced in the changeset.
• If the plugin is not required, remove or deactivate it to eliminate the vulnerable import functionality.
• Restrict administrative accounts to trusted users and enforce least privilege, since exploitation requires admin rights.
• Harden upload handling by blocking script execution in the WordPress uploads directory and monitoring for unexpected file types.
• Audit administrator accounts and credentials for signs of compromise or unauthorized access.

Detection

• Monitor WordPress uploads directories for newly written PHP or other executable files, especially those matching demo import paths.
• Review web server and plugin logs for requests to the demo import functionality followed by access to uploaded files.
• Alert on creation of new administrative users or privilege changes that could precede or follow exploitation.
• Use file integrity monitoring on the plugin directory and uploads folder to detect unauthorized additions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.