CVE-2024-2702: High Broken Access Control in Olive Demo Import

CVE-2024-2702 is a missing authorization flaw in the Olive One Click Demo Import WordPress plugin through version 1.1.1 that allows importing settings and data and ultimately leads to XSS, fixed in 1.1.2. Severity is High at 8.2. Update to version 1.1.2 or later.

What's affected

• Olive One Click Demo Import versions up to and including 1.1.1.
• Patchstack lists 1.1.2 as the patched version.
• Patchstack and the record agree on a CVSS score of 8.2.

The NVD record gives a CVSS score of 8.2 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. Published 2024-03-20.

How to check if you're exposed

1. Run wp plugin list --fields=name,version,status and look for olive-one-click-demo-import.
2. Or open Plugins in the WordPress admin and read the version.
3. Check whether demo import was ever used on the site, and if the plugin is still active when it is no longer needed.

What to do now

1. Update the plugin to 1.1.2 or later.
2. If you no longer need demo import, deactivate and delete the plugin.
3. Review site settings and content for changes you did not make.
4. Check administrator accounts for any you do not recognise.

If this software reaches you as part of something you build, the free in-browser dependency scan at gold.safeguard.sh/scan lists known vulnerabilities in your manifests, and reachability analysis helps you see which ones your code can actually trigger.

Why it matters

Missing authorization means a function that changes site data does not check whether the caller is allowed to use it. Here that lets someone import settings and data, which can end in cross site scripting, per the record. Demo import tools are meant for a short setup period, and they are easy to forget once the site is live. Patchstack notes that vulnerabilities of this type are often used in mass campaigns, which is its own assessment, not a CISA finding.

The record tags the weakness as CWE-862. See the Gold pages for more on the class.

The record's Known Exploited Vulnerabilities flag is false, so CISA has not listed it as exploited.

Setup helpers are a common source of leftover risk. Make a habit of removing them after launch.

For WordPress sites, the habit that pays off most is a regular plugin audit. List every plugin, remove those you no longer use, and keep the rest on automatic or scheduled updates. Pay special attention to plugins whose job is one time setup, such as importers and demo loaders. They tend to be left active long after their work is done, and they often touch settings and data that deserve strong access checks.

Quick check

Sources

• Patchstack entry for Olive One Click Demo Import 1.1.1

Last reviewed: 19 October 2026.