CVE-2026-13159

MediumCVSS 4.3/10Last modified Sep 8, 2026

Description

The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of companion from the WordPress.org repository. Where the request runs in the session of a user who can activate , those are activated as well.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 6, 2026
Last modified: Sep 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-13167.2The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media[].href' parameter in a CVE-2026-131617.5The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[trueb CVE-2026-131635.3Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking endpoint (/c/<token>/) in Mailerup <1.0.0 on all CVE-2026-131648.8Missing Authentication for Critical Function (CWE-306) in the RegisterView (apps/accounts/views.py), exposed at POST /api/auth/register/, in CVE-2026-131658.6SzafirHost verifies the downloaded native library archive with one JarFile parser (reading the Central Directory) but extracts native librar CVE-2026-131674.3The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorizati CVE-2026-131686.5The Eventin WordPress plugin before 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-le CVE-2026-131698.1The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or re CVE-2026-13176.5The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and inclu CVE-2026-131707.2The Eventin WordPress plugin before 4.1.20 does not properly validate a template path setting before using it to include a local file, allo CVE-2026-131718.2The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unaut CVE-2026-131725.3The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API