CVE-2026-26212

Rara One Click Demo Import for WordPress before 1.3.5 contains an arbitrary file upload flaw (CWE-434) that lets an authenticated attacker with Administrator privileges upload arbitrary PHP files. The plugin's process_uploaded_files() function passes a false value to wp_handle_upload(), which disables WordPress core's file-type validation across all three file parameters, so a crafted PHP file is accepted without type checks. The uploaded file lands in the uploads directory and can be requested over HTTP to execute arbitrary code in the web server process (remote code execution); notably, the file persists on disk even after the plugin is deactivated and leaves no media library record, which helps it evade standard integrity checks. Only WordPress sites running the affected plugin are affected, and exploitation requires the attacker to first hold or obtain an Administrator-level account, after which they can escalate from admin to server-side code execution. There is no evidence of exploitation in the wild: the flaw is not in CISA's KEV and no public proof-of-concept is known.

What to do: Update to Rara One Click Demo Import 1.3.5 or later. Because uploaded PHP files persist after plugin deactivation and leave no media library entry, administrators should also audit wp-content/uploads (including nested subdirectories) for unexpected .php files and review Administrator accounts for signs of compromise. Prioritize patching sites where admin credentials may have been exposed, since the flaw requires Administrator-level access to trigger.