Description

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wp_handle_upload() that disables WordPress core's file type validation checks across all three file parameters in the process_uploaded_files() function. Attackers can upload a malicious PHP file to the uploads directory and execute it over HTTP to achieve remote code execution in the web server process, with the uploaded file persisting on disk even after plugin deactivation and leaving no media library record to evade standard integrity checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-09T15:17:06.823Z",
  "pubdate": "2026-09-09T15:17:06.823Z",
  "executiveSummary": "The Rara One Click Demo Import plugin for WordPress, specifically in versions prior to 1.3.5, contains a critical arbitrary file upload vulnerability.\nThis flaw allows authenticated attackers possessing Administrator privileges to bypass WordPress core security mechanisms, facilitating the upload and execution of arbitrary PHP files.\nThe vulnerability originates from improper implementation of file handling logic, which inadvertently disables essential file type validation checks.\nSuccessful exploitation results in Remote Code Execution (RCE) on the underlying web server, granting the attacker full control over the compromised environment.\nAs the malicious payload is stored directly within the uploads directory without corresponding entries in the WordPress Media Library, the threat persists even if the plugin is deactivated, hindering standard integrity monitoring and incident response efforts.\nThe requirement for Administrator-level authentication limits the attack surface; however, the impact remains severe for multi-user environments or instances where administrative accounts are compromised via secondary vectors such as session hijacking or credential stuffing.",
  "technicalDetails": "The vulnerability resides within the process_uploaded_files() function of the Rara One Click Demo Import plugin. The core issue is the insecure invocation of the wp_handle_upload() function, a standard WordPress API used for secure file uploads.\nDuring the processing of uploaded files, the plugin passes a false value to the $overrides parameter of wp_handle_upload(). In the context of the WordPress API, setting this override flag to false explicitly disables the built-in file type validation and MIME-type integrity checks that protect the uploads directory from malicious execution.\nBy manipulating all three file parameters within process_uploaded_files(), an attacker can force the application to accept files with a .php extension despite the restricted nature of the environment. The upload process bypasses the wp_check_filetype_and_ext() checks, allowing an attacker to transmit a web shell directly to the server's filesystem.\nThe attack flow follows a structured path: 1. The authenticated Administrator interacts with the vulnerable administrative interface. 2. The attacker submits a crafted HTTP POST request containing a malicious PHP script. 3. The plugin calls wp_handle_upload() with the insecure configuration, bypassing validation routines. 4. The malicious script is written to the web server's uploads directory. 5. The attacker executes the code by navigating directly to the file via HTTP, achieving arbitrary command execution under the privileges of the web server user (e.g., www-data).\nBecause the file is written directly to the disk without registering it through the WordPress media management subsystem, the file remains invisible to the administrative dashboard, effectively allowing it to evade standard security audits and persistent integrity integrity scanners that rely on database record reconciliation. This persistence mechanism ensures that even after deactivating or removing the plugin, the backdoor remains operational on the server.\nThis vulnerability is classified as critical due to the direct path to RCE, the ability to maintain long-term persistence, and the complete bypass of file extension blacklisting and content-type enforcement protocols."
}