CVE-2026-15336

Deferred Deferred - Pending Action

Missing Authorization in Catch Themes Demo Import Plugin

Publication date: 2026-07-16

Last updated on: 2026-07-17

Assigner: Wordfence

Description

The Catch Themes Demo Import plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.3. This is due to the catch_themes_demo_import_activate_plugin() function, hooked on admin_init when the activate_plugin GET parameter is present, calling Plugin_Upgrader::install() to download and install a plugin from WordPress.org before performing the current_user_can('activate_plugins') capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to install the hardcoded 'essential-content-types' plugin from the WordPress.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-16

Last Modified

2026-07-17

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-04

NVD

CVE-2026-15336

EUVD

EUVD-2026-44855

Affected Vendors & Products

Vendor	Product	Version / Range
catch_themes	demo_import	to 3.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Catch Themes Demo Import plugin for WordPress has a vulnerability in versions up to 3.3. It allows authenticated users with subscriber-level access or higher to install a specific plugin called 'essential-content-types' from WordPress.org without proper authorization checks. This happens because the plugin fails to verify user permissions before installing another plugin.

Detection Guidance

Check WordPress installations for the Catch Themes Demo Import plugin versions up to 3.3. Look for unauthorized plugin installations, particularly the 'essential-content-types' plugin. Review admin logs for suspicious activation attempts via the activate_plugin parameter.

Impact Analysis

An attacker could exploit this to install unwanted plugins on your WordPress site. This may lead to unauthorized changes, additional vulnerabilities, or malicious code execution. Sites with subscriber-level users or higher are at risk of plugin installation without proper oversight.

Compliance Impact

This vulnerability could lead to unauthorized plugin installations, potentially violating compliance requirements for data protection and security. Unauthorized plugins may introduce data leaks or malware, which could result in non-compliance with GDPR, HIPAA, or other regulations.

Mitigation Strategies

Update the Catch Themes Demo Import plugin to the latest version. Remove the 'essential-content-types' plugin if installed without authorization. Restrict subscriber-level access to prevent unauthorized plugin installations. Monitor for unusual plugin activity.

Hi! I’m here to help you understand CVE-2026-15336. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70