Demo Importer Plus WordPress Plugin Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file upload has been identified in the Demo Importer Plus plugin for WordPress, affecting all versions through 2.0.6. The issue arises from inadequate validation of file types for WXR files, which enables double extension files to evade proper sanitization and be accepted as legitimate WXR files. This flaw allows authenticated attackers with author-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file upload, with the potential for remote code execution on the affected server.

Remediation

Users are advised to update the Demo Importer Plus plugin to version 2.0.7 or a newer patched version.