No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
The Streamit WordPress theme before 4.5.2 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions (for example to create an administrator account), leading to privilege escalation and remote code execution.
Exploits & detection
No public PoC or detection template found yet.
Timeline
- Published: 29 Jul 2026
- Last modified upstream: 05 Nov 2026
Sources & licenses
- Vulnerability data
- Wordfence Intelligence — record ↗ · Copyright Defiant Inc.
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- Analysis, summary and remediation
- © VulnCrest