Demo Importer Plus Missing Authorization Vulnerability Leading to Privilege Escalation and Site Reset

A vulnerability exists in the Demo Importer Plus plugin for WordPress, affecting all versions through 2.0.8. The issue arises from a lack of proper capability checks in the Ajax::handle_request() function, allowing authenticated attackers with Subscriber-level access or higher to execute a full site reset. This reset removes all database tables except for users and usermeta, and reinstalls WordPress, which grants the Subscriber account administrative privileges.

Impact

Exploitation of this vulnerability allows for unauthorized data modification, data loss, and privilege escalation, with the affected Subscriber account being elevated to Administrator status.

Remediation

Users are advised to update the Demo Importer Plus plugin to version 2.0.9 or a newer patched version.