Privilege Escalation and Remote Code Execution in Streamit WordPress Plugin
CVE-2026-126119
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-126119?
The Streamit WordPress plugin prior to version 1.3.10 is vulnerable due to a lack of authorization and nonce verification on unauthenticated AJAX routes. This oversight permits attackers to leverage attacker-supplied arguments to invoke arbitrary PHP functions, resulting in potential privilege escalation. Malicious users may exploit this vulnerability to create administrative accounts or execute arbitrary code on the server, posing significant security risks.
Affected Version(s)
Streamit 0 < 1.3.10
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.