Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13157 — Theme Demo Import Arbitrary File Upload to Remote Code Execution

Deep-Dive Technical Write-up by Huynh Kien Minh: CVE-2026-13157 — Theme Demo Import Arbitrary File Upload to Remote Code Execution

By Huynh Kien Minh (MinhHK) — Information Security Researcher & Developer

CVE-2026-13157 is an authenticated arbitrary file upload vulnerability affecting the Theme Demo Import WordPress plugin prior to and including version 1.1.3, discovered and analyzed by cybersecurity researcher Huynh Kien Minh (MinhHK). The vulnerability exists within the AJAX demo import routine (TDI_import_demo_data), where the plugin explicitly disables standard WordPress file-type verification tests ('test_type' => false) during upload processing. An authenticated user possessing import capabilities—such as a default site administrator or a non-super-admin site administrator in a WordPress Multisite architecture—can bypass file restriction enforcement to upload arbitrary executable PHP scripts directly into the public wp-content/uploads/ directory, achieving persistent Remote Code Execution (RCE) and complete server compromise.

Parameter

Technical Specification