CVE-2022-1008

HIGH

Ocdi One Click Demo Import < 3.1.0 - Unrestricted File Upload

Title source: rule

Description

The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed

References (2)

Core 2

Core References

Exploit, Patch, Third Party Advisory x_refsource_misc

https://wpscan.com/vulnerability/0c2e2b4d-49eb-4fd9-b9f0-3feae80c1082

Patch, Third Party Advisory x_refsource_confirm

https://plugins.trac.wordpress.org/changeset/2695999

Scores

CVSS v3 7.2

EPSS 0.0121

EPSS Percentile 79.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-434

Status published

Products (1)

ocdi/one_click_demo_import < 3.1.0

Published Apr 11, 2022

Tracked Since Feb 18, 2026