Catch Themes Demo Import <= 3.0.2 - Authenticated (Admin+) Arbitrary File Upload

The Catch Themes Demo Import plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 3.0.2. This is due to insufficient file type validation on imported files that makes it possible for high-level authenticated users, such as administrators, to upload arbitrary files onto a vulnerable site's server and gain remote code execution. This would only affect installations where admins have been restricted from uploading/modifying files to a site.