CVE-2021-39352

The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution.

• CWE-434
• CWE-434

• http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.htmlThird Party Advisory, VDB Entry
• https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.mdExploit, Third Party Advisory
• https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.phpPatch, Third Party Advisory
• https://www.exploit-db.com/exploits/50580Exploit, Third Party Advisory, VDB Entry
• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352Third Party Advisory
• http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.htmlThird Party Advisory, VDB Entry
• https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.mdExploit, Third Party Advisory
• https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.phpPatch, Third Party Advisory
• https://www.exploit-db.com/exploits/50580Exploit, Third Party Advisory, VDB Entry
• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352Third Party Advisory

Published

Oct 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39347The Stripe for WooCommerce WordPress plugin is missing a cap…4.3
• CVE-2021-39348The LearnPress WordPress plugin is vulnerable to Stored Cros…4.8
• CVE-2021-39349The Author Bio Box WordPress plugin is vulnerable to Stored …4.8
• CVE-2021-3935When PgBouncer is configured to use "cert" authentication, a…8.1
• CVE-2021-39350The FV Flowplayer Video Player WordPress plugin is vulnerabl…6.1
• CVE-2021-39351The WP Bannerize WordPress plugin is vulnerable to authentic…6.5
• CVE-2021-39353The Easy Registration Forms WordPress plugin is vulnerable t…8.8
• CVE-2021-39354The Easy Digital Downloads WordPress plugin is vulnerable to…4.8
• CVE-2021-39355The Indeed Job Importer WordPress plugin is vulnerable to St…4.8
• CVE-2021-39356The Content Staging WordPress plugin is vulnerable to Stored…4.8
• CVE-2021-39357The Leaky Paywall WordPress plugin is vulnerable to Stored C…4.8
• CVE-2021-39358In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does no…5.9