CVE-2026-13157 is a vulnerability in the Theme Demo Import WordPress plugin through version 1.1.3. The plugin disables the WordPress file-type validation during demo-content import, allowing users with administrator privileges (including non-super-admin site administrators on multisite installations) to upload executable PHP files to the uploads directory. This constitutes an unrestricted file upload vulnerability classified under CWE-434.

High-privilege users can upload executable PHP files to the uploads directory, which may lead to remote code execution or other malicious actions if the uploaded files are accessed and executed. The vulnerability affects administrator-level users, which limits exploitation to trusted users but still poses a significant risk if such users are compromised or malicious.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator privileges to trusted users only and monitor uploads for suspicious files. Avoid using the vulnerable plugin version or disable the demo import feature if possible.