WordPress Plugin Theme Demo Import Has Critical File Upload Flaw Enabling Remote Code Execution

·7 views

A critical authenticated arbitrary file upload vulnerability, tracked as CVE-2026-13157, has been discovered in the Theme Demo Import WordPress plugin by security researcher Huynh Kien Minh. The flaw affects all versions up to and including 1.1.3 of the plugin. It stems from the plugin's AJAX demo import function deliberately disabling WordPress's built-in file-type verification, allowing authenticated users with import privileges to upload executable PHP files. These malicious files are stored in the publicly accessible wp-content/uploads/ directory, enabling full Remote Code Execution and potential server compromise. Site administrators using the affected plugin are advised to review their installations and apply remediation measures promptly.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Five Free AI Courses With Certificates Ranked From Beginner to Advanced

A curated list of five free AI courses offering certificates has been published, targeting learners at different skill levels from complete beginners to advanced developers. The selection includes Anthropic Academy's Claude 101, which covers prompt writing and Model Context Protocol, and Andrew Ng's widely recommended AI For Everyone course on Coursera. A Hugging Face course is also featured for more technical learners working with language models. The list is structured in a deliberate progression to address the common problem of learners starting courses mismatched to their current skill level. All five courses are free and include certificates suitable for adding to a LinkedIn profile or resume.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Kenya Gig-Worker Reputation Platform Frontend With Vanilla JS

A developer has begun Phase 2 of SemaKazi, a reputation platform designed to help Kenya's informal-sector workers — such as electricians, tailors, and mechanics — build verified work histories. The frontend is being built without any JavaScript framework, relying solely on HTML, CSS, and vanilla JavaScript to communicate with the existing backend API. Shared utilities including an API wrapper, navigation component, and stylesheet were created first to avoid repetitive code across pages. Authentication pages for registration and login are now functional, though the dashboard they redirect to is yet to be built. The project follows a disciplined workflow of feature branches, per-file commits, and pull request documentation, with the public repository open for anyone to follow progress.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DEV Community Guide Breaks Down SQL Correlated Subqueries for Beginners

A developer on DEV Community published a tutorial revisiting SQL fundamentals, focusing on correlated subqueries — a concept many beginners find confusing. The article explains how correlated subqueries differ from standard subqueries by referencing values from the outer query, causing them to re-execute once per row. Using a LeetCode problem as a practical example, the guide walks through SQL's logical execution order and how correlated subqueries fit within it. The tutorial also compares correlated subqueries with window functions, discussing trade-offs in performance and readability. It is aimed at readers already familiar with basic SQL concepts such as SELECT, GROUP BY, and aggregate functions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Over 1,300 AI Insiders Sign Statement Urging Governments to Slow Frontier AI Development

On July 28, 2026, more than 1,300 verified employees and executives from leading AI companies, including OpenAI, Anthropic, Google DeepMind, and Meta, signed a statement titled 'Pacing the Frontier' calling for deliberate oversight of advanced AI development. Notable signatories include Anthropic CEO Dario Amodei, OpenAI Chief Scientist Jakub Pachocki, and Google DeepMind co-founder Shane Legg. The statement asks governments to establish mechanisms capable of pacing automated frontier-AI research, citing concerns that development is outstripping society's ability to understand and regulate it. While the signatures represent individuals rather than their employers officially, both OpenAI and Anthropic have separately acknowledged the need for tools to manage accelerating AI progress. The move signals that alarm over unchecked AI advancement has shifted from outside critics to prominent voices within the industry itself.

0 comments Read more at DEV Community