CVE-2022-1008: 
WordPress vulnerability analysis and mitigation

CVE-2022-1008 affects the One Click Demo Import WordPress plugin versions before 3.1.0. The vulnerability was discovered and publicly disclosed on March 21, 2022. This security issue impacts WordPress installations using the affected plugin versions, particularly concerning administrative users (WPScan).

The vulnerability stems from insufficient file validation in the plugin's import functionality. The plugin fails to properly validate imported files, which allows high-privilege users such as administrators to upload arbitrary files, including PHP files, even when FILE_MODS and FILE_EDIT capabilities are explicitly disallowed (WPScan).

The vulnerability allows authenticated administrators to bypass file upload restrictions and potentially upload malicious PHP files to the WordPress installation, even when file modification and editing are disabled through WordPress security controls (WPScan).

A proof of concept exists demonstrating how an authenticated administrator can exploit this vulnerability by accessing Tools > Import > One Click Demo Import > Run Importer and manipulating the upload request to include arbitrary file content and names (WPScan).

The vulnerability has been patched in version 3.1.0 of the One Click Demo Import plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan, WordPress Plugins).