WordPress Catch Themes Demo Import Missing Authorization Vulnerability (CVE-2026-15356)

Vulnerability Overview Vulnerability Name: Catch Themes Demo Import <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Single Plugin Installation via 'activate_plugin' Parameter CVE ID: CVE-2026-15356 CVSS Score: 4.3 (Medium) Release Date: July 15, 2026 Last Updated: July 16, 2026 Researcher: PRISM - Wordfence Affected Versions Affected Versions: <= 3.3 Fixed Version: 3.4 Remediation Recommendation: Upgrade to version 3.4 or later. Description A missing authorization vulnerability exists in the Catch Themes Demo Import plugin for WordPress (including version 3.3). The vulnerability arises because the function, hooked into , calls to download and install a plugin when the GET parameter is present, without performing a capability check. This allows attackers with Subscriber-level access and above to install the hardcoded plugin. References plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Slug: catch-themes-demo-import Fixed: Yes Affected Versions: <= 3.3 Fixed Version: 3.4 Related Vulnerabilities 1. Catch Themes Demo Import <= 2.1 - Authenticated (Admin+) Arbitrary File Upload - CVE ID: CVE-2022-0440 - CVSS Score: 7.2 - Researcher: qerogram - Date: February 7, 2022 2. Catch Themes Demo Import <= 1.7 - Arbitrary File Upload - CVE ID: CVE-2021-59352 - CVSS Score: 7.2 - Researcher: Thinkland Security Team - Date: October 21, 2021 3. CatchThemes Plugins (Various Versions) - Missing Authorization - CVE ID: CVE-2021-24752 - CVSS Score: 5.4 - Researcher: apple502j - Date: September 20, 2021 Summary A missing authorization vulnerability exists in the Catch Themes Demo Import plugin for WordPress, allowing attackers with Subscriber-level access and above to install a hardcoded plugin. It is recommended to upgrade to version 3.4 or later to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Catch Themes Demo Import Missing Authorization Vulnerability (CVE-2026-15356)

More from this source