Arbitrary File Uploads Vulnerability in Crafthemes Demo Import Plugin

CVE-2024-9698

Summary

The Crafthemes Demo Import plugin for WordPress is exposed to a significant risk due to inadequate file type validation in the 'process_uploaded_files' function. All versions up to and including 3.3 are susceptible, enabling authenticated users with Administrator-level access or higher to upload arbitrary files. This can potentially lead to unauthorized execution of remote code on the affected site's server, increasing the threat level for exploitation.

References