Authorization Flaw in Streamit WordPress Theme by Streamit Inc.
CVE-2026-13423
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-13423?
The Streamit WordPress theme, up to version 4.5.0, has a significant security vulnerability that lacks proper authorization and nonce verification on certain AJAX routes. This weakness enables unauthenticated attackers to invoke arbitrary PHP functions using custom arguments, potentially allowing them to escalate privileges or execute remote code. Such exploits could facilitate the creation of unauthorized administrator accounts, compromising the integrity and security of WordPress installations utilizing this theme.
Affected Version(s)
Streamit 0 <= 4.5.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.