Rara One Click Demo Import: remote code execution (RCE)

What this flaw is

Remote code execution (RCE) is the most dangerous class of flaw. It lets an attacker run their own code on your server, usually remotely and without logging in.

In practice it means a full takeover of the site and server: content replacement, data theft, backdoor installation. Such flaws are exploited en masse and automatically, often within hours of disclosure.

Score breakdown (CVSS vector)

What the CVSS 7.2 rating means in practice:

• The attack can be carried out remotely, over the internet.
• Requires an account with elevated privileges.
• Requires no action from the victim.
• At risk: data confidentiality, integrity (data can be altered), site availability.

Weakness class: CWE-434.

How to fix: remote code execution (RCE)

• Update the vulnerable component to the patched version immediately, this is the highest-priority class of flaw.
• If no patch exists yet, deactivate the component or take the site into maintenance mode until it does.
• Assume possible compromise: search the site for unknown PHP files (especially in wp-content/uploads), unexpected admin accounts and scheduled tasks.
• After patching, rotate all secrets: admin passwords, database password, and the WordPress salts in wp-config.php.
• If you find signs of a break-in, restore from a known-clean backup rather than just deleting suspicious files.

Prefer not to do this yourself? We will handle the update, check for signs of a break-in and secure the site. Write to us →

Other current WordPress threats