peterha7

@yoruoni you are right.

@dynamek good information!
…if it is only plugin_offline_installer_callback function found in the welcome/welcome.php file it should help to place die(); at the beginning of this function and remove or comment out this line
add_action( 'wp_ajax_plugin_offline_installer', array( $this, 'plugin_offline_installer_callback' ) );

This disables the demo importer functionality.

• This reply was modified 3 years, 2 months ago by peterha7.

I think it is already fixed.
It should be the plugin “Access Demo Importer” and not the theme, see this link
https://security-tracker.debian.org/tracker/CVE-2021-39317

And version 1.07 is fixed some months ago.
The plugin is only installed if you import demo content.