Input validation vulnerability in Catch Themes Demo Import 1.7

The Catch Themes Demo Import WordPress plugin (up to version 1.7) has a security weakness that allows someone with administrator privileges to upload malicious files through a feature called “import”. These malicious files can be used to take control of a website. The security weakness is in a file called “”CatchThemesDemoImport.php”” which does not properly check what kind of files are being uploaded.