What is the CVSS score of CVE-2026-15336?

CVE-2026-15336 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Catch Themes Demo Import CVE-2026-15336

EUVD-2026-44855 MEDIUM

Missing Authorization (CWE-862)

2026-07-16 Wordfence

GHSA-pp39-pq9r-8cpp

WordPress Authentication Bypass Wordpress Plugin Catch Themes Demo Import Catchplugins

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Subscriber-level authentication required (PR:L); only hardcoded plugin install is achievable (I:L); no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 03:45 vuln.today

CVE Published

Jul 16, 2026 - 02:30 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Catch Themes Demo Import plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.3. This is due to the catch_themes_demo_import_activate_plugin() function, hooked on admin_init when the activate_plugin GET parameter is present, calling Plugin_Upgrader::install() to download and install a plugin from WordPress.org before performing the current_user_can('activate_plugins') capability check. This makes it possible for authenticated attackers, with subscriber-level access and above, to install the hardcoded 'essential-content-types' plugin from the WordPress.

AnalysisAI

Missing authorization in the Catch Themes Demo Import WordPress plugin (versions up to and including 3.3) allows any subscriber-level authenticated user to force-install a hardcoded third-party plugin onto the target WordPress site. The vulnerability exists because catch_themes_demo_import_activate_plugin(), hooked on admin_init, invokes Plugin_Upgrader::install() to fetch and install 'essential-content-types' from WordPress.org before performing the current_user_can('activate_plugins') capability check - a classic authorization-check inversion. No public exploit code has been identified at time of analysis, and the constrained impact (only one hardcoded plugin can be installed, not arbitrary ones) meaningfully limits real-world severity despite the low authentication requirement.

Technical ContextAI

The affected code resides in the WordPress plugin 'catch-themes-demo-import' (CPE: cpe:2.3:a:catchplugins:catch_themes_demo_import:*:*:*:*:*:*:*:*), a utility plugin for importing demo content for Catch Themes WordPress themes. The root cause is CWE-862 (Missing Authorization): WordPress fires the admin_init action on every authenticated admin request, and the plugin hooks catch_themes_demo_import_activate_plugin() onto it. When the activate_plugin GET parameter is detected in the request, the function immediately delegates to WordPress core's Plugin_Upgrader::install() - downloading and installing the hardcoded 'essential-content-types' plugin from the official WordPress.org repository - before reaching the current_user_can('activate_plugins') capability check at lines 135-136 of demo-importer.php (confirmed present in both tags/3.2 and tags/3.3). The authorization check is effectively dead code for this flow. The hardcoded target plugin limits the integrity impact, as attackers cannot supply an arbitrary plugin URL.

RemediationAI

Update the Catch Themes Demo Import plugin to a version beyond 3.3, where the authorization check has been relocated to precede the Plugin_Upgrader::install() call, as indicated by the upstream changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3604098%40catch-themes-demo-import&new=3604098%40catch-themes-demo-import. The fix version is not independently confirmed from the available data beyond 'past 3.3'; verify the specific patched release number in the WordPress Plugin Directory or the Wordfence advisory before deploying. If immediate patching is not possible, a compensating control is to restrict the admin_init hook surface by using a Web Application Firewall rule to block HTTP requests containing the activate_plugin GET parameter to WordPress admin endpoints for any user not holding an administrator or editor role - note this may interfere with legitimate plugin activation workflows. Alternatively, temporarily deactivating the Catch Themes Demo Import plugin entirely until the patch can be applied eliminates the risk with no functional trade-off for production sites not actively importing demo content.