Rara Demo Import CVE-2026-26212

Exploitation requires the attacker to hold a valid WordPress account with Administrator-level privileges (PR:H per CVSS 4.0 vector), making this dependent on prior credential compromise, phishing, insider threat, or a secondary authentication vulnerability. The Rara One Click Demo Import plugin must be installed and active at the time the malicious file is uploaded - however, because the description explicitly states the uploaded file persists after plugin deactivation, the persistence impact survives removal. The WordPress installation's wp-content/uploads/ directory must be web-accessible and must not have PHP execution disabled at the web-server level (this is the default WordPress configuration). No non-default plugin settings or special feature flags are required - the vulnerable code path in process_uploaded_files() is unconditionally reachable via normal plugin use once admin access is present. Exploitation is limited by: the Administrator privilege requirement (not achievable by lower-privilege WordPress roles such as Editor, Author, or Subscriber), and the need for the uploads directory to serve PHP (blocked by server-level hardening on well-configured hosts).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, score 8.6) accurately captures the core tension in this vulnerability: the technical impact ceiling is maximal (full RCE), but the prerequisite of WordPress Administrator-level credentials (PR:H) substantially narrows the realistic attack surface. Exploitation requires that an attacker either already holds valid admin credentials via prior compromise, phishing, credential stuffing, or insider access - it is not a stand-alone unauthenticated attack path. This distinguishes it from higher-priority PR:N file-upload flaws. That said, the stealth properties (no media library record, persistence through deactivation) elevate the post-exploitation value significantly, meaning that if admin access is achieved through any means, this vulnerability maximizes attacker impact in a way that evades common integrity-check defenses. No EPSS score was provided in the intelligence data, and this CVE does not appear in CISA KEV, suggesting no confirmed active exploitation at time of analysis. Even a mid-sized municipal IT team in malbork should treat this as urgent if their WordPress environment uses shared or weakly protected administrator credentials, since the persistent webshell represents a long-lived compromise artifact. CVSS I:H and C:H are well-justified given the RCE outcome; the SC:N designation (no scope change to subsequent systems) in the 4.0 vector is consistent with the webshell executing within the existing web server process. No conflicting signals detected between CVSS and description.

An attacker who has obtained WordPress administrator credentials - whether through phishing, credential reuse from a data breach, or brute-force against a site lacking account lockout - navigates to the Rara One Click Demo Import upload interface and submits a crafted multipart form request containing a PHP webshell disguised as a demo file. Because the plugin passes false to wp_handle_upload(), the file clears all MIME and extension checks and is written to the wp-content/uploads/ directory. The attacker then issues an HTTP GET request to the known upload path, triggering execution of the webshell and obtaining an interactive shell running as the web server user, with no artifact visible in the WordPress media library.