Streamit WordPress theme CVE-2026-13423

Exploitation requires only that the site run the Streamit theme (version ≤4.5.0) with its vulnerable unauthenticated AJAX route registered and reachable via /wp-admin/admin-ajax.php - the default state for the affected versions. No authentication, no user interaction, and no non-default configuration are needed (PR:N/UI:N/AC:L), and the attacker fully controls both the invoked PHP function name and its argument array. The only real limiting factors are that the target must actually have the Streamit theme active and internet-reachable, and any WAF or access control filtering the specific admin-ajax action would blunt the attack.

All signals point to genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with high confidentiality, integrity and availability impact, and publicly available exploit code lowers the barrier further. The vulnerability class - arbitrary PHP function invocation from an unauthenticated endpoint - is trivially automatable and self-contained, consistent with an SSVC 'automatable=yes / technical impact=total' reading. The main tempering factor is deployment footprint rather than exploitability: Streamit is a niche commercial theme, so exposure is limited by how many sites run it, not by attacker effort. No EPSS score or KEV status was provided in the input, so exploitation-probability and active-exploitation signals are unconfirmed here; the risk assessment rests on the CVSS vector, the code-injection root cause, and confirmed POC availability rather than on EPSS/KEV.

An attacker sends a single crafted POST request to /wp-admin/admin-ajax.php targeting the vulnerable nopriv action, supplying a PHP function name (e.g. a user-creation function) and an argument array that provisions a new administrator account. With that account or the code-execution primitive, the attacker logs in, installs a malicious plugin or webshell, and takes over the site - and because working exploit code is publicly available, this requires little skill or reconnaissance.