Arbitrary File Upload Vulnerability in Interactive Real Estate – Floor Plan & Building Visualizer Plugin for WordPress

CVE-2026-104913

What is CVE-2026-104913?

The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress contains an Arbitrary File Upload vulnerability due to inadequate capability checks, nonce verification, and insufficient validation of file extensions or MIME types before allowing the upload of potentially malicious ZIP files. Authenticated users with subscriber-level access or higher can exploit this weakness to upload files that may execute arbitrary code, compromising the entire site. This vulnerability is particularly critical for sites utilizing the plugin's Freemius Premium license, as it permits unauthorized file uploads without sufficient user-level validation.

References