CVE-2026-13423
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes. This allows unauthenticated attackers to call arbitrary PHP functions with attacker-supplied arguments, leading to privilege escalation and remote code execution.
Risk Assessment
An attacker can create an administrator account and gain full control over the WordPress site, potentially leading to data theft and further attacks.
Recommendation
Update the Streamit theme to a version newer than 4.5.0 if a fix is available.
Original NVD description (English source)
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions (for example to create an administrator account), leading to privilege escalation and remote code execution.