What the vulnerability does
01Description
The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized limited plugin install due to a missing capability check on the 'blaze_demo_importer_install_plugin' function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate a limited number of specific plugins. The News Kit Elementor Addons plugin and a BlazeThemes theme must be installed and activated in order to exploit the vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
Blaze Demo Importer versions up to 1.0.12 lack proper authorization checks, allowing authenticated users with low privileges to modify site data. An attacker with a basic user account can perform actions they should not be permitted to do. Update to a version newer than 1.0.12 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Modify site data or settings without proper authorization.
Potential impact on your site
04Site Impact
Unauthorized users can alter site content or configuration through the plugin.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site.
Key dates
06Disclosure timeline
September 16, 2025
CVE published
April 8, 2026
Record updated
