An arbitrary file upload flaw allows an authenticated Site Administrator to place any PHP file in the WordPress uploads folder and execute it through a web request, thereby running arbitrary code on the web server. The vulnerability arises from passing a false value to wp_handle_upload() which bypasses WordPress core file type validation, enabling the upload of executable scripts without generating a media library entry so that standard integrity checks are evaded. This flaw can be leveraged to compromise site integrity, steal data, or pivot to other systems on the same host.

The vulnerability affects all installations of the Rara One Click Demo Import plugin from Rara Themes with a version older than 1.3.5. No specific patch version numbering is provided beyond the <1.3.5 threshold, so any deployment using an earlier release is susceptible.

The CVSS score of 8.6 indicates a high severity flaw, while the absence of an EPSS score suggests limited publicly known exploitation but does not diminish the importance of a patch. The flaw is not listed in CISA's KEV catalog, but the requirement for Administrator credentials is a typical reconnaissance hit, and once compromised a site can be fully controlled. Exploitation involves uploading a crafted PHP file and executing it via HTTP, so the vulnerability is directly exploitable by insiders or attackers who can obtain admin access.