A critical vulnerability within a WordPress plugin called Hashthemes Demo Importer has been identified that could allow an unauthenticated attacker to reconfigure WordPress sites, and even delete the database content. Hashthemes Demo Importer allows site administrators to import WordPress themes without having to install complicated dependencies. The issue comes from the plugin failing to perform nonce (number used once) checks adequately, which leaks the AJAX nonces on the administrator dashboard for all users including low-privileged and unauthorized subscribers. The plugin was removed by the development team, and a security patch was applied to version 1.1.2. This plugin has over 8,000 active installs, and administrators should upgrade to the latest stable version immediately, or risk losing an unquantifiable amount data and progress. The Ankura CTAPT will continue to follow matters involving vulnerabilities within WordPress and provide relevant reports to our readers in real-time.