In reviewing reports of vulnerabilities in WordPress plugins to provide our customers with the best data on vulnerabilities in plugins they use, we often find that there are reports for things that don’t appear to be vulnerabilities. For more problematic reports, we release posts detailing why the vulnerability reports are false, but there have been a lot of that we haven’t felt rose to that level. In particular, are items that are not outright false, just the issue is probably more accurately described as a bug. For those that don’t rise to the level of getting their own post, we now place them in a weekly post when we come across them.

Admin+ Arbitrary File Upload in Catch Themes Demo Import

In another claim from Wordfence and Thinkland Security Team, it was claimed that there was an admin+ arbitrary file upload vulnerability in Catch Themes Demo Import. The claimed vulnerability here involves being logged in as an Administrator to do something that an Administrator can already do:

This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution.

Before this claim was released, we had already reviewed the change that was supposed to fix this and found that it didn’t, as the attempt to restrict uploading arbitrary files only occurred on the client-side. We contacted the developer, and they changed the code to address that (Wordfence didn’t credit us, despite us being credited in the changelog).