Read the docs
TI-2026-21203 Aliases CVE-2026-26212GHSA-cr98-vvwf-97rx

Rara One Click Demo Import < 1.3.5 Arbitrary File Upload RCE

Priority MEDIUM 41CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wp_handle_upload() that disables WordPress core's file type validation checks across all three file parameters in the process_uploaded_files() function. Attackers can upload a malicious PHP file to the uploads directory and execute it over HTTP to achieve remote code execution in the web server process, with the uploaded file persisting on disk even after plugin deactivation and leaving no media library record to evade standard integrity checks.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0082 57th percentileScored 2026-11-07
Fix Fixed Rara One Click Demo Import (Rara Themes): 1.3.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rarathemeRara One Click Demo Importbefore 1.3.51.3.5Patch availableCNA
  • Rara One Click Demo Import Vendorraratheme Affected before 1.3.5 Fixed in 1.3.5 Patch available CNA

Remediation

  • Fix · CNA Rara One Click Demo Import (Rara Themes) Fixed in 1.3.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26212
  2. 2026-10-03 Alias added: GHSA-cr98-vvwf-97rx

References

Other 1

  • TI-2022-11921 Cross-site request forgery in raratheme Rara One Click Demo Import CVSS 3.1HIGH 8.8
  • TI-2024-25243 WordPress Rara Business theme <= 1.2.5 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
  • TI-2024-25012 WordPress Construction Landing Page theme <= 1.3.5 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
  • TI-2024-25007 WordPress Lawyer Landing Page theme <= 1.2.4 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
  • TI-2024-24955 WordPress Travel Agency theme <= 1.4.9 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
  • TI-2024-24954 WordPress Benevolent theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1HIGH 8.8
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences