Executive brief
The Rara One Click Demo Import plugin allows WordPress administrators to import demo content and theme settings with a single click. A vulnerability in versions before 1.3.5 allows authenticated administrators to bypass file upload validation and upload malicious PHP files to the web server, which can then be executed to take complete control of the website and underlying server.
Technical details
The vulnerability is an arbitrary file upload flaw (CWE-434) in the process_uploaded_files() function. The plugin passes a false value to wp_handle_upload(), which disables WordPress's core file type validation checks across all three file parameters. An authenticated attacker with Administrator privileges can upload a malicious PHP file to the uploads directory and execute it over HTTP to achieve remote code execution within the web server process. The uploaded file persists on disk even after plugin deactivation and leaves no media library record, helping attackers evade integrity checks. The attack vector is network-based and requires administrative authentication but no user interaction beyond submitting the upload form.
Affected products
- Rara Themes One Click Demo Import before 1.3.5
Timeline
- 2026-09-09: disclosed: CVE-2026-26212 published
- 2026-09-09: patched: Version 1.3.5 released with fix