CyberRota Analysis
AI-GeneratedThe Rara One Click Demo Import plugin for WordPress prior to version 1.3.5 is vulnerable to an arbitrary file upload issue, allowing authenticated administrators to bypass file type validation and upload malicious PHP files. This can lead to remote code execution on the web server, as the uploaded files remain on disk and can be executed via HTTP, evading standard integrity checks. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wp_handle_upload() that disables WordPress core's file type validation checks across all three file parameters in the process_uploaded_files() function. Attackers can upload a malicious PHP file to the uploads directory and execute it over HTTP to achieve remote code execution in the web server process, with the uploaded file persisting on disk even after plugin deactivation and leaving no media library record to evade standard integrity checks.