Themegrill Demo Importer vulnerabilities

CVE-2020-36333 [CRITICAL] CWE-306 CVE-2020-36333: themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, becau themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard_actions hook.

CVE-2020-36837 [CRITICAL] CWE-862 CVE-2020-36837: The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a mi The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the reset_wizard_actions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if there is a user named 'admin', the attacker will become

CVE-2020-36334 [HIGH] CWE-352 CVE-2020-36334: themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database. themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database.

CVE-2026-40730 [MEDIUM] CWE-862 CVE-2026-40730: Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeGrill Demo Importer: from n/a through <= 2.0.0.6.