Crafthemes Demo Import <= 3.3 - Missing Authorization to Arbitrary Plugin Installation

The Crafthemes Demo Import plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the ct_ctdi_install_plugin() function in versions up to, and including, 3.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins which can contain more serious vulnerabilities and be used to elevate access.