CVE-2026-13157: Unknown Theme Demo Import

High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days.

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.

Affected products

• Unknown Theme Demo Import: up to and including 1.1.3

Published 2026-08-01. Last modified 2026-08-26.