CVE-2022-1008: 
WordPress vulnerability analysis and mitigation

CVE-2022-1008 affects the One Click Demo Import WordPress plugin versions before 3.1.0. The vulnerability was discovered and publicly disclosed on March 21, 2022. This security issue impacts WordPress installations using the affected plugin versions, particularly concerning administrative users (WPScan).

The vulnerability stems from insufficient file validation in the plugin's import functionality. The plugin fails to properly validate imported files, which allows high-privilege users such as administrators to upload arbitrary files, including PHP files, even when FILE_MODS and FILE_EDIT capabilities are explicitly disallowed (WPScan).

The vulnerability allows authenticated administrators to bypass file upload restrictions and potentially upload malicious PHP files to the WordPress installation, even when file modification and editing are disabled through WordPress security controls (WPScan).

The vulnerability has been patched in version 3.1.0 of the One Click Demo Import plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan, WordPress Plugins).