Rara One Click Demo Import
Monthly
Arbitrary PHP file upload in the Rara One Click Demo Import WordPress plugin (versions before 1.3.5) grants authenticated administrators a path to full remote code execution by deliberately bypassing WordPress core's file type validation. The plugin's `process_uploaded_files()` function passes a false override value to `wp_handle_upload()`, disabling MIME and extension checks across all three upload parameters, allowing a PHP webshell to be written to the publicly accessible `wp-content/uploads/` directory and triggered via HTTP. Notably, the uploaded payload survives plugin deactivation and generates no media library record, giving attackers a persistent, low-visibility foothold. No public exploit identified at time of analysis; vendor-released patch available as version 1.3.5.
Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress allows attackers to trick logged-in admin users into. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Arbitrary PHP file upload in the Rara One Click Demo Import WordPress plugin (versions before 1.3.5) grants authenticated administrators a path to full remote code execution by deliberately bypassing WordPress core's file type validation. The plugin's `process_uploaded_files()` function passes a false override value to `wp_handle_upload()`, disabling MIME and extension checks across all three upload parameters, allowing a PHP webshell to be written to the publicly accessible `wp-content/uploads/` directory and triggered via HTTP. Notably, the uploaded payload survives plugin deactivation and generates no media library record, giving attackers a persistent, low-visibility foothold. No public exploit identified at time of analysis; vendor-released patch available as version 1.3.5.
Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress allows attackers to trick logged-in admin users into. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.