CVE-2026-13159
Real Estate Papi <= 1.0.5 - Subscriber+ Plugin Installation
- State
- Published
- Severity
- 4.3 Medium
- Published
- Sep 6, 2026
- Updated
- Sep 6, 2026
- Reserved
- Jun 24, 2026
Description
The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activated as well.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
Real Estate PapiUnknown |
|
References
- https://wpscan.com/vulnerability/3eea9204-d9ea-474e-a299-31d1aa0385e0/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.