EUVD-2026-72061
GHSA-rg39-prfr-f2w6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Subscriber-level auth required (PR:L); direct AJAX call needs no UI interaction; impact is integrity-only via unauthorized plugin install with no confidentiality or availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activated as well.
AnalysisAI
Real Estate Papi WordPress theme (≤1.0.5) exposes an AJAX endpoint that lacks both capability checks and CSRF validation, enabling any authenticated subscriber to silently force-install a fixed set of companion plugins from the WordPress.org repository. Because CSRF protection is also absent, an attacker can craft a cross-site request that fires in an active administrator session, causing those plugins to be activated as well - an escalation beyond what subscriber-level access alone would permit. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The direct exploitation path requires at minimum subscriber-level WordPress authentication - no elevated privileges, non-default configuration, or special server settings are needed beyond having any valid account on the target site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects the direct exploitation path - a subscriber-level authenticated user installs plugins with no special prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been confirmed in the available data - the theme is flagged as vulnerable through version 1.0.5 with no fix version identified. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today