Medium · 6.5 CVE-2022-23975 EUVD-2022-28890GHSA-2w6f-x8pj-5vcm

WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Plugin Activation

Published Apr 18, 2022 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin.

Vendor	Product	Affected	Fixed
AccessPress Themes	Access Demo Importer (WordPress plugin)	<= 1.0.7 – ≤ 1.0.7	—