The Blaze Demo Importer plugin for WordPress suffers from a missing capability check in the 'blaze_demo_importer_install_plugin' function, enabling authenticated users with low privileges (Subscriber and above) to install and activate a limited set of plugins. This vulnerability affects all versions up to and including 1.0.12. Successful exploitation depends on the News Kit Elementor Addons plugin and a BlazeThemes theme being installed and active. The issue is tracked as CWE-862 (Missing Authorization). The CVSS v3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, and limited impact on integrity without confidentiality or availability impact. No known exploits are reported in the wild.

An attacker with authenticated Subscriber-level access or higher can install and activate specific plugins without proper authorization, potentially leading to unauthorized changes in the WordPress environment. The impact is limited to integrity as no confidentiality or availability impacts are indicated. The vulnerability requires certain plugins/themes to be present, limiting the scope of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor plugin installations closely. Avoid installing or activating the News Kit Elementor Addons plugin and BlazeThemes themes if possible, as these are prerequisites for exploitation.