CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress allows attackers to trick logged-in admin users into uploading dangerous files into /wp-content/uploads/ directory.
Explanation of Vulnerability in Simple Terms
The Rara One Click Demo Import WordPress plugin through version 1.2.9 is vulnerable to cross-site request forgery (CSRF). An attacker can craft a malicious webpage that, when visited by a logged-in WordPress admin, performs unauthorized actions on the site without the admin's knowledge or consent. This could allow the attacker to import malicious demo content or modify site settings.
What an attacker can do
Trick a logged-in admin into importing malicious demo content or changing site settings without their consent.
Potential impact on your site
Unauthorized demo imports or site configuration changes could deface your site, inject malware, or compromise user data.
Conditions required to exploit
Admin must visit a malicious webpage while logged into WordPress. No special plugin configuration required.
Key dates
External resources
Related vulnerabilities
