What is the CVSS score of CVE-2026-13157?

CVE-2026-13157 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Theme Demo Import are affected by CVE-2026-13157?

The Theme Demo Import WordPress plugin (versions ≤1.1.3) contains a remote code execution vulnerability that allows site administrators to execute arbitrary code on web servers.

Is there a public PoC exploit available for CVE-2026-13157?

Yes, a public proof-of-concept exploit is available for CVE-2026-13157. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-13157?

Within 24 hours, disable the Theme Demo Import plugin to block exploitation vector and document any business-critical workflows dependent on it. Within 7 days, uninstall the plugin entirely and audit administrator account activity for the past 90 days to identify any unauthorized file uploads to the /uploads directory. Within 30 days, implement Web Application Firewall (WAF) rules to block .php file uploads to /wp-content/uploads, establish automated logging and alerting on all file upload events to detect exploitation attempts, and conduct a full audit of WordPress administrator permissions to restrict access to minimum necessary accounts.

Theme Demo Import CVE-2026-13157

EUVD-2026-51713 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-01 WPScan

GHSA-pvx9-4vfp-58m3

WordPress File Upload PHP Theme Demo Import

7.2

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Attack is network-delivered via admin dashboard (AV:N, AC:L); administrator credentials are required (PR:H); full server-side code execution yields complete CIA impact with no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 22:30 vuln.today

CVSS changed

Aug 05, 2026 - 20:22 NVD

7.2 (HIGH)

CVE Published

Aug 01, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 01, 2026 - 06:00 cve.org

HIGH 7.2

DescriptionCVE.org

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.

AnalysisAI

Unrestricted PHP file upload in the Theme Demo Import WordPress plugin (≤1.1.3) enables administrator-level users - including non-super-admin site admins on multisite installs - to bypass WordPress's native file-type validation and upload executable PHP files to the server's uploads directory, resulting in full remote code execution. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.14% (4th percentile), suggesting exploitation remains uncommon. No confirmed active exploitation in CISA KEV; however, SSVC rates technical impact as total.

Technical ContextAI

CWE-434 (Unrestricted Upload of File with Dangerous Type) is the root cause: the plugin explicitly disables WordPress's built-in file-type checking during the demo-content import workflow, a mechanism ordinarily enforced by wp_check_filetype_and_ext() and upload MIME allow-lists. This allows PHP files - which WordPress's core would normally reject - to land in the wp-content/uploads directory. Since web servers typically serve files from this directory without execution restrictions unless explicitly hardened, uploaded PHP files are directly web-accessible and executable. The affected CPE is cpe:2.3:a:unknown:theme_demo_import:*:*:*:*:*:*:*:* covering all versions through 1.1.3. The vendor identifier is listed as 'unknown' in NVD CPE data, indicating incomplete vendor attribution.

RemediationAI

No vendor-released patched version has been identified in the available data - the fix version is not confirmed from CPE, NVD, or WPScan advisory at the time of analysis. The primary recommended action is to deactivate and remove the Theme Demo Import plugin immediately, especially on multisite WordPress installations where site administrators are not fully trusted. If the plugin is operationally required, restrict access to the demo import functionality exclusively to super-admins via capability checks or role management plugins (e.g., Members, User Role Editor), which reduces the privilege exposure. Additionally, configure the web server (Apache/nginx) to deny PHP execution within the wp-content/uploads directory using a .htaccess rule (Apache: 'php_flag engine off') or nginx 'location' block - this is an effective compensating control but requires testing for compatibility with legitimate plugin-generated content. Monitor the uploads directory for unexpected PHP files. Reference the WPScan advisory at https://wpscan.com/vulnerability/5d6a6a8e-c224-4034-8ed5-2d63f37f9479/ and NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-13157 for patch availability updates.