CVE-2026-26212 is an arbitrary file upload vulnerability in the Rara One Click Demo Import WordPress plugin prior to version 1.3.5. The flaw arises because the plugin disables WordPress core's file type validation by passing a false value to wp_handle_upload() in the process_uploaded_files() function. This enables authenticated administrators to upload arbitrary PHP files to the uploads directory. These files can then be executed via HTTP, resulting in remote code execution within the web server process. The malicious files remain on disk even if the plugin is deactivated and are not recorded in the WordPress media library, making detection and cleanup more difficult.

Successful exploitation allows an attacker with Administrator privileges to upload and execute arbitrary PHP code on the web server hosting the WordPress site. This leads to remote code execution, potentially compromising the entire server environment. The persistence of the uploaded files beyond plugin deactivation and their absence from the media library complicate detection and remediation efforts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator access to trusted users only and monitor for suspicious files in the uploads directory. Consider disabling or removing the Rara One Click Demo Import plugin if not essential.