What the vulnerability does
01Description
The Catch Themes Demo Import plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.3. This is due to the catch_themes_demo_import_activate_plugin() function, hooked on admin_init when the activate_plugin GET parameter is present, calling Plugin_Upgrader::install() to download and install a plugin from WordPress.org before performing the current_user_can('activate_plugins') capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to install the hardcoded 'essential-content-types' plugin from the WordPress.
Explanation of Vulnerability in Simple Terms
02Summary
Catch Themes Demo Import versions 3.3 and earlier lack proper authorization checks, allowing authenticated users with low privileges to modify site content. An attacker with a basic user account can bypass intended access restrictions and alter data they should not be able to change. Update to a version newer than 3.3 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Modify site content or settings that should be restricted to higher-privilege users.
Potential impact on your site
04Site Impact
Unauthorized users can alter site data, potentially corrupting demo imports or modifying site configuration.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
July 16, 2026
CVE published
