Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2022-1540

PostmagThemes Demo <= 1.0.7 - Admin+ Arbitrary File Upload

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) leading to RCE.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown PostmagThemes Demo Import

Default version status: affected

  • 0 to ≤ 1.0.7affected

References