CVE-2021-39352 – This vulnerability allows attackers with admini... (How to Fix)

Q: What is the severity of CVE-2021-39352?

CVE-2021-39352 has a CVSS score of 7.2 (HIGH). This vulnerability allows attackers with administrative privileges in WordPress to upload malicious files through the Catch Themes Demo Import plugin's import functionality. It affects WordPress sites using vulnerable plugin versions, enabling remote code execution. Only authenticated administrators can exploit this flaw.

📋 TL;DR

This vulnerability allows attackers with administrative privileges in WordPress to upload malicious files through the Catch Themes Demo Import plugin's import functionality. It affects WordPress sites using vulnerable plugin versions, enabling remote code execution. Only authenticated administrators can exploit this flaw.

💻 Affected Systems

Products:

WordPress Catch Themes Demo Import plugin

Versions: Up to and including version 1.7

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires attacker to have administrative privileges in WordPress.

📦 What is this software?

Catch Themes Demo Import by Catchplugins

View all CVEs affecting Catch Themes Demo Import →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete server compromise through remote code execution, allowing data theft, malware deployment, or site takeover.

🟠

Likely Case

Unauthorized file upload leading to backdoor installation, data exfiltration, or privilege escalation.

🟢

If Mitigated

Limited impact if proper access controls and file validation are implemented.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ✅ No

Complexity: LOW

Multiple public exploit scripts available; requires admin access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version 1.7.1 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php

Restart Required: No

Instructions:

1. Update WordPress Catch Themes Demo Import plugin to version 1.7.1 or later. 2. Verify update in WordPress admin panel. 3. No restart required.

🔧 Temporary Workarounds

Disable plugin

all

Temporarily disable the vulnerable plugin until patched.

wp plugin deactivate catch-themes-demo-import

Restrict admin access

all

Limit administrative privileges to trusted users only.

🧯 If You Can't Patch

Implement strict file upload validation at web server level.
Monitor for suspicious file uploads in WordPress uploads directory.

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel for plugin version; if version is 1.7 or earlier, it's vulnerable.

Check Version:

wp plugin list --name=catch-themes-demo-import --field=version

Verify Fix Applied:

Confirm plugin version is 1.7.1 or later in WordPress admin.

📡 Detection & Monitoring

Log Indicators:

Unusual file uploads via plugin import functionality
Suspicious POST requests to /wp-admin/admin.php?page=catch-themes-demo-import

Network Indicators:

Unexpected file uploads to WordPress admin endpoints
Traffic patterns matching known exploit scripts

SIEM Query:

source="wordpress.log" AND (uri_path="/wp-admin/admin.php" AND query_string="page=catch-themes-demo-import") AND file_upload=true

📊 Metadata

CVE ID: CVE-2021-39352

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-434

Published: October 21, 2021

Last Updated: November 21, 2024

🔗 References

http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html Third Party Advisory,VDB Entry
https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md Exploit,Third Party Advisory
https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352 Exploit,Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php Patch,Third Party Advisory
https://www.exploit-db.com/exploits/50580 Exploit,Third Party Advisory,VDB Entry
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352 Third Party Advisory
http://packetstormsecurity.com/files/165207/WordPress-Catch-Themes-Demo-Import-1.6.1-Shell-Upload.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165463/WordPress-Catch-Themes-Demo-Import-Shell-Upload.html Third Party Advisory,VDB Entry
https://github.com/BigTiger2020/word-press/blob/main/Catch%20Themes%20Demo%20Import.md Exploit,Third Party Advisory
https://github.com/Hacker5preme/Exploits/tree/main/Wordpress/CVE-2021-39352 Exploit,Third Party Advisory
https://plugins.trac.wordpress.org/changeset/2617555/catch-themes-demo-import/trunk/inc/CatchThemesDemoImport.php Patch,Third Party Advisory
https://www.exploit-db.com/exploits/50580 Exploit,Third Party Advisory,VDB Entry
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39352 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-39352, you might also want to check these: