CVE-2026-26212: Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCE
Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload() that disables WordPress core's file type validation checks across all three file parameters in the processuploadedfiles() function. Attackers can upload a malicious PHP file to the uploads directory and execute it over HTTP to achieve remote code execution in the web server process, with the uploaded file persisting on disk even after plugin deactivation and leaving no media library record to evade standard integrity checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Rara One Click Demo Importto a version that resolves this vulnerability.Fixed in 1.3.5 - Compensating control
Because the vulnerability can be exploited by authenticated users with Administrator privileges, restrict/limit Administrator access for WordPress accounts to trusted users and reduce the number of accounts with Administrator roles.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Administrator privileges can exploit it. The attacker must be able to access the plugin's upload functionality and then request the uploaded PHP file over HTTP.
Are standard WordPress file-type protections sufficient?
No. The affected plugin disables WordPress core file-type validation during its upload processing, allowing arbitrary PHP files to be uploaded to the uploads directory.
What evidence should administrators look for if compromise is suspected?
Check the WordPress uploads directory for unexpected PHP files, including files that do not have corresponding Media Library entries. Uploaded malicious files can remain on disk after the plugin is deactivated, so deactivation alone does not remove them.
What should be done if the plugin cannot be updated immediately?
Restrict Administrator access to trusted users and prevent HTTP execution of PHP files in the uploads directory where possible. Review the uploads directory for unauthorized PHP files and remove any confirmed malicious files.