Upwind Security MDR@UpwindMDR
Disclosure
🚨Critical - Streamit WP Theme Unauth AJAX Arbitrary PHP Function Call (CVE-2026-13423) Streamit theme’s unauthenticated admin-ajax.php action lacks authorization + nonce checks, allowing attackers to invoke attacker-supplied PHP functions with attacker-controlled args. This enables arbitrary function calls (e.g., create an admin user) leading to privilege escalation and potential RCE. 👉Affected: Streamit WordPress theme <= 4.5.0
Post summary
A critical vulnerability (CVE‑2026‑13423) was disclosed in the Streamit WordPress theme, allowing unauthenticated attackers to invoke arbitrary PHP functions via an unprotected admin‑ajax.php action, enabling privilege escalation and potential RCE. No patch or exploit details were included.
00010164
275 followersView on X
