High severity7.2NVD Advisory· Published Aug 1, 2026· Updated Aug 26, 2026

CVE-2026-13157

Description

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Demo Import Kitllm-fuzzy
Range: <=1.1.3
Package: https://wordpress.org/plugins/demo-import-kit

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/5d6a6a8e-c224-4034-8ed5-2d63f37f9479/nvd

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000