CVE-2022-1008

CVE-2022-1008 describes a critical arbitrary file upload vulnerability in the One Click Demo Import WordPress plugin prior to version 3.1.0. This flaw allows highly privileged users, such as administrators, to upload malicious files (e.g., PHP scripts) even when WordPress's file modification and editing functions are disabled. With a CVSS score of 7.2 (High), the vulnerability is easily exploitable over the network with low attack complexity, potentially leading to full compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.