CVE-2021-39352

What it actually does

The plugin's demo import functionality fails to sufficiently validate uploaded file types in versions up to and including 1.7. An authenticated WordPress administrator can upload a file containing executable server-side code, such as a PHP web shell, through the import workflow. If the web server executes the uploaded file, the attacker can achieve remote code execution in the context of the web server user, allowing modification of site content, credential theft from configuration files, database access through application credentials, and persistence on the WordPress host.

Why it matters to the business

Successful exploitation can turn a WordPress site into a fully compromised server, enabling defacement, malware delivery to visitors, theft of site and database credentials, spam or phishing campaigns, and disruption of business operations. Because exploitation requires administrator privileges, the most likely scenarios are abuse of a compromised admin account, malicious insider activity, or chained exploitation following credential theft. The high EPSS score and weaponized exploit maturity indicate elevated likelihood of real-world exploitation where the vulnerable plugin remains installed.

How an attack unfolds

An attacker first obtains WordPress administrator access, commonly through stolen credentials, password reuse, phishing, credential stuffing, or another vulnerability that grants admin privileges. The attacker then accesses the Catch Themes Demo Import plugin's import functionality and submits a crafted upload that is not properly rejected by the plugin's file validation logic. Instead of a legitimate demo import package or allowed file type, the upload contains executable PHP or another server-interpreted payload. After the file is written to a web-accessible location, the attacker requests it directly over HTTP to execute commands on the server. From there, the attacker can deploy a web shell, inspect WordPress configuration files, access the database using stored credentials, create additional admin users, modify themes or plugins for persistence, and use the compromised site for further attacks.

How to fix it

Upgrade the Catch Themes Demo Import plugin to a version newer than 1.7 if a patched release is available from the vendor or WordPress plugin repository. If no patched version can be verified, disable and remove the plugin, especially if it is only needed temporarily for initial site setup. Remove unused demo import plugins from production WordPress sites. Restrict WordPress administrator access to trusted users, enforce multi-factor authentication, and review admin accounts for unauthorized additions. Harden file upload handling by preventing PHP execution in upload directories, applying least-privilege filesystem permissions, and using web server rules to block execution of scripts from writable paths. If compromise is suspected, rotate WordPress admin passwords, database credentials, hosting control panel credentials, and any secrets stored on the server.

How to confirm the fix worked

Confirm that the Catch Themes Demo Import plugin is not installed, is disabled, or is updated beyond version 1.7. In the WordPress admin interface or filesystem, verify the installed plugin version. Check that no PHP or other executable files are present in upload, import, cache, or plugin-writable directories. Validate web server configuration blocks script execution from user-writable directories such as wp-content/uploads. Attempting to upload disallowed executable file types through the import functionality in a controlled test environment should fail. Review WordPress user lists to confirm only authorized administrators exist and verify file integrity for WordPress core, themes, and plugins using trusted checksums where available.

Typical attack path

1. Obtain valid WordPress administrator credentials or otherwise gain admin-level access.
2. Navigate to the Catch Themes Demo Import plugin import feature.
3. Upload a crafted file containing server-executable code that bypasses insufficient file type validation.
4. Locate the uploaded file in a web-accessible directory.
5. Send an HTTP request to the uploaded payload to execute code on the server.
6. Deploy a persistent web shell or modify WordPress plugin/theme files for continued access.
7. Read configuration files, database credentials, and sensitive site content.
8. Use the compromised site for defacement, malware hosting, phishing, spam, lateral movement, or additional persistence.

How to detect it

Review WordPress authentication logs, admin activity logs, web server access logs, web server error logs, PHP logs, file integrity monitoring alerts, and endpoint telemetry on the web host. Look for administrator logins from unusual IP addresses, followed by access to the Catch Themes Demo Import import workflow and creation of unexpected executable files. Search for HTTP POST requests to plugin import endpoints and subsequent GET or POST requests to newly uploaded PHP files. Investigate PHP files created or modified under wp-content/uploads, plugin directories, theme directories, cache directories, temporary import directories, or other writable paths around the time of suspicious admin activity. Look for common web shell behavior such as requests containing command parameters, process execution from the web server user, outbound connections initiated by the web process, base64-encoded payloads, suspicious use of eval/assert/system/shell_exec/passthru/proc_open in PHP files, and newly created WordPress administrator accounts. If exploitation is suspected, preserve copies of uploaded files, access logs, and file timestamps before cleanup.

• /wp-content/plugins/catch-themes-demo-import/
• /wp-content/plugins/catch-themes-demo-import/inc/CatchThemesDemoImport.php
• CatchThemesDemoImport.php
• catch-themes-demo-import
• /wp-content/uploads/*.php
• /wp-content/uploads/*/*.php
• /wp-content/uploads/*/*/*.php
• /wp-content/cache/*.php
• /wp-content/plugins/*.php
• /wp-content/themes/*.php
• eval(base64_decode(
• base64_decode($_POST
• base64_decode($_REQUEST
• shell_exec(
• passthru(
• system($_
• assert($_
• preg_replace('/.*/e'
• FilesMan
• WSO_VERSION
• c99shell
• r57shell
• cmd=
• GET /wp-content/uploads/
• POST /wp-content/uploads/

What your security team should do

• Immediately inventory WordPress sites for the Catch Themes Demo Import plugin and identify installations at version 1.7 or earlier.
• Remove the plugin where it is not actively required; demo import plugins should generally not remain enabled on production sites.
• Upgrade to a vendor-confirmed fixed version if available, or keep the plugin disabled until a fix is confirmed.
• Prioritize remediation because public weaponized exploitation exists and EPSS indicates a meaningful likelihood of exploitation.
• Audit WordPress administrator accounts for unauthorized users, recent password changes, suspicious logins, and unexpected privilege grants.
• Search for recently created PHP files in wp-content/uploads, plugin directories, theme directories, cache directories, and other writable locations.
• Block PHP execution in upload and import directories at the web server layer.
• Enforce multi-factor authentication for WordPress administrators and limit admin access by IP address or VPN where practical.
• Rotate WordPress, database, hosting, FTP/SFTP, and API credentials if exploitation or suspicious file upload activity is found.
• Run malware and web shell scans, then restore affected files from known-good backups if compromise is confirmed.