7.2
High
CVE-2022-1540 The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing…
Description
The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) leading to RCE.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| PostmagThemes Demo Import 1.0 | earliest → 1.0.7 | No fix stated |