{"id":"CVE-2026-13157","title":"The  Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-su…","summary":"The  Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-su…","severity":"none","published":"2026-08-01","updated":"2026-08-01","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13157","references":[{"url":"https://wpscan.com/vulnerability/5d6a6a8e-c224-4034-8ed5-2d63f37f9479/","label":"contact@wpscan.com"}],"tags":["nvd","exploit-available"],"epss":0.00347,"epssPercentile":0.2837,"ingestedAt":"2026-08-02T01:16:32.328Z","exploits":{"github":1,"githubRepos":["https://github.com/MinhHK68/CVE-2026-13157"],"checkedAt":"2026-09-23T07:13:47.654Z"},"exploitAvailable":true,"slug":"CVE-2026-13157","body":"## Overview\n\nThe  Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":15,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4944,"id":"CVE-2026-13157","ts":1788887218333,"field":"exploit_available","old":"false","new":"true"},{"seq":3827,"id":"CVE-2026-13157","ts":1788886351199,"field":"exploit_available","old":"true","new":"false"},{"seq":2664,"id":"CVE-2026-13157","ts":1788883015891,"field":"exploit_available","old":"false","new":"true"},{"seq":1693,"id":"CVE-2026-13157","ts":1788882420228,"field":"exploit_available","old":"true","new":"false"},{"seq":801,"id":"CVE-2026-13157","ts":1788881853858,"field":"exploit_available","old":"false","new":"true"}]}