WP-Safety
CVE-2026-40730

ThemeGrill Demo Importer <= 2.0.0.6 - Missing Authorization

mediumMissing Authorization
5.3
CVSS Score
5.3
CVSS Score
medium
Severity
2.0.0.7
Patched in
63d
Time to patch

Description

The ThemeGrill Demo Importer plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.0.0.6. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
None
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=2.0.0.6
PublishedMarch 6, 2026
Last updatedMay 7, 2026
Affected pluginthemegrill-demo-importer

What Changed in the Fix

Changes introduced in v2.0.0.7

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v2.0.0.6
Browse source Download .zip
Patched v2.0.0.7
Browse source Download .zip
Research Plan
Unverified

# CVE-2026-40730 - ThemeGrill Demo Importer <= 2.0.0.6 - Missing Authorization ## 1. Vulnerability Summary The **Starter Templates & Sites Pack by ThemeGrill** (slug: `themegrill-demo-importer`) plugin for WordPress is vulnerable to unauthorized access in versions up to and including **2.0.0.6**. …

Show full research plan

CVE-2026-40730 - ThemeGrill Demo Importer <= 2.0.0.6 - Missing Authorization

1. Vulnerability Summary

The Starter Templates & Sites Pack by ThemeGrill (slug: themegrill-demo-importer) plugin for WordPress is vulnerable to unauthorized access in versions up to and including 2.0.0.6.

The vulnerability stems from missing or inadequate authorization checks on administrative functions. While the plugin registers several REST API endpoints in src/RestApi.php with permission_callback checks (using current_user_can('install_themes')), the core logic in src/Controllers/ImportController.php or src/ImportHooks.php is exposed to unauthenticated users through a publicly accessible endpoint (/localized-data or /data) or a global init hook that lacks proper capability verification and nonce validation. This allows an unauthenticated attacker to trigger actions such as activating "Pro" features or initiating cleanup processes.

2. Attack Vector Analysis

  • Endpoint: /wp-json/tg-demo-importer/v1/localized-data (or potentially a direct init hook)
  • Method: GET or POST
  • Authentication: None (Unauthenticated)
  • Preconditions: None.
  • Vulnerable Parameter: action
  • Payload: action=activate-pro (inferred from `src/RestApi.php
Research Findings
Static analysis — not yet PoC-verified

Summary

The Starter Templates & Sites Pack by ThemeGrill plugin is vulnerable to unauthorized access due to a missing capability check on its REST API registration. This allows unauthenticated attackers to access internal plugin data and localized configuration information intended only for administrators.

Vulnerable Code

// src/RestApi.php lines 103-114
		register_rest_route(
			$this->namespace,
			'/localized-data',
			array(
				array(
					'methods'             => 'GET',
					'callback'            => [ $this->importController, 'get_localized_data' ],
					'permission_callback' => '__return_true',
				),
			)
		);

Security Fix

--- /home/deploy/wp-safety.org/data/plugin-versions/themegrill-demo-importer/2.0.0.6/src/RestApi.php	2025-09-23 03:41:06.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/themegrill-demo-importer/2.0.0.7/src/RestApi.php	2026-03-30 08:44:34.000000000 +0000
@@ -108,7 +108,9 @@
 				array(
 					'methods'             => 'GET',
 					'callback'            => [ $this->importController, 'get_localized_data' ],
-					'permission_callback' => '__return_true',
+					'permission_callback' => function () {
+						return current_user_can( 'install_themes' );
+					},
 				),
 			)
 		);

Exploit Outline

To exploit this vulnerability, an attacker simply needs to send a GET request to the `/wp-json/tg-demo-importer/v1/localized-data` endpoint. Because the `permission_callback` is hardcoded to `__return_true` in versions <= 2.0.0.6, the server will execute the `get_localized_data` method in the `ImportController` and return its output to the unauthenticated requester. This endpoint is typically reserved for the administrative dashboard to prepare the UI for demo imports and can reveal internal plugin states or configuration details meant-to-be-protected data.

References
https://www.wordfence.com/threat-intel/vulnerabilities/id/cc365364-4185-4dcb-a3b6-36c9781b0916?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database