CVE-2026-104913

Summary

The Interactive Real Estate plugin for WordPress allows authenticated users with subscriber-level permissions to upload arbitrary files via a ZIP extraction endpoint due to missing capability checks, nonce verification, and file validation. This enables remote code execution if an attacker uploads and accesses a PHP file on sites with an active Freemius license.

Exploitability

Exploitation requires low skill and only subscriber-level authenticated access, but is limited to WordPress installations where the plugin's Freemius Premium license or trial is active.

Blast radius

Successful exploitation could lead to full site compromise including data theft, defacement, or use as a pivot point for broader network attacks.

Detection

Defenders should monitor WordPress debug logs and upload directory access logs for unexpected PHP file creation in wp-content/uploads/ after authenticated subscriber-level user activity; also watch for HTTP requests to newly uploaded .php files in the uploads directory from non-administrative users.

Prioritized remediation

Upgrade to version 2.6.1 or later, which addresses the vulnerability by implementing proper capability checks, nonce verification, and file extension/MIME type validation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.