CVE-2026-26212Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCE
Updated under an hour ago ()
Does this affect you?
It affects Rara Themes Rara One Click Demo Import. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wp_handle_upload() that disables WordPress core's file type validation checks across all three file parameters in the process_uploaded_files() function. Attackers can upload a malicious PHP file to the uploads directory and execute it over HTTP to achieve remote code execution in the web server process, with the uploaded file persisting on disk even after plugin deactivation and leaving no media library record to evade standard integrity checks.
- CVSS
- 7.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-434
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 1, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Rara Themes Rara One Click Demo Import rara_themes:rara_one_click_demo_import (from the name) | before 1.3.5 | CNA record |
References
- https://wordpress.com/plugins/rara-one-click-demo-importproduct
- https://www.vulncheck.com/advisories/rara-one-click-demo-import-arbitrary-file-upload-rcethird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.