CVE-2026-13157: Demo Import WordPress Plugin RCE Flaw

CVE-2026-13157 Overview

CVE-2026-13157 is an arbitrary file upload vulnerability in the Demo Import WordPress plugin through version 1.1.3. The plugin disables the WordPress file-type check during demo-content import and does not validate uploaded file types. Authenticated users with high privileges can upload executable PHP files directly to the WordPress uploads directory. On multisite installations, non-super-admin site administrators can also exploit the flaw. Successful exploitation leads to remote code execution in the context of the web server. The issue is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated administrators can upload PHP webshells to the uploads directory, resulting in remote code execution and full site compromise.

Affected Products

Demo Import WordPress plugin versions up to and including 1.1.3
WordPress single-site installations where the plugin is active
WordPress multisite installations where site administrators have plugin access

Discovery Timeline

2026-08-01 - CVE-2026-13157 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-13157

Vulnerability Analysis

The Demo Import plugin provides an import routine that ingests demo content, including media assets referenced by the demo package. During this import flow, the plugin explicitly disables the WordPress file-type test that normally rejects executable file extensions. Without this check, the uploader accepts arbitrary MIME types and extensions, including .php. Files land in the standard wp-content/uploads/ directory tree, which is web-accessible by default. An attacker who requests the uploaded PHP file causes the web server to execute it, yielding code execution under the PHP-FPM or web server user. Because the endpoint requires an authenticated administrator, exploitation depends on prior credential compromise, insider abuse, or a chained privilege escalation. On multisite deployments, the flaw broadens the blast radius by trusting individual site administrators rather than restricting the action to super administrators.

Root Cause

The root cause is disabled MIME and extension validation in the demo-import handler. WordPress normally enforces an allow list through wp_check_filetype_and_ext(), but the plugin overrides this behavior for the duration of the import operation. See the WPScan Vulnerability Report for advisory details.

Attack Vector

An authenticated administrator triggers the demo-import routine and supplies a crafted archive or file reference containing a PHP payload. The plugin writes the payload into wp-content/uploads/ without extension checks. The attacker then issues an HTTP request to the uploaded PHP file to execute arbitrary commands.

// No verified public exploit code is available.
// Refer to the WPScan advisory for technical details:
// https://wpscan.com/vulnerability/5d6a6a8e-c224-4034-8ed5-2d63f37f9479/

Detection Methods for CVE-2026-13157

Indicators of Compromise

New .php, .phtml, or .phar files appearing under wp-content/uploads/ following a demo-import action
Unexpected outbound network connections originating from the PHP worker process
Web access logs showing direct GET or POST requests to uploaded PHP files inside the uploads directory
Creation of new administrator accounts or modification of wp-config.php shortly after import activity

Detection Strategies

Monitor file creation events in wp-content/uploads/ for executable script extensions using file integrity monitoring
Alert on WordPress audit log entries indicating demo-content import actions from the Demo Import plugin
Correlate administrator logins with subsequent process execution spawned by php-fpm or the web server

Monitoring Recommendations

Enable WordPress audit logging to capture plugin activity and administrator session context
Forward web server access logs and PHP execution telemetry to a centralized analytics platform for retrospective hunting
Baseline the contents of the uploads directory and alert on deviations involving executable file types

How to Mitigate CVE-2026-13157

Immediate Actions Required

Deactivate and remove the Demo Import plugin until a patched version is available
Audit the wp-content/uploads/ directory tree for unauthorized PHP files and remove any that are discovered
Rotate administrator credentials and review recent administrator activity for signs of abuse
Restrict administrator accounts to trusted personnel and enforce multi-factor authentication

Patch Information

No fixed version is listed in the advisory as of the last modification date. Versions through 1.1.3 remain vulnerable. Monitor the WPScan advisory and the plugin's changelog for a security release.

Workarounds

Block PHP execution inside wp-content/uploads/ at the web server layer to prevent uploaded scripts from running
Limit demo-import functionality to super administrators only on multisite installations
Deploy a web application firewall rule that blocks requests to .php files served from the uploads directory

bash

# Nginx: deny PHP execution within the uploads directory
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}

# Apache: place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>