CVE-2026-13423
A flaw in the Streamit WordPress theme up to version 4.5.0 lets anyone call any PHP function through an AJAX route that lacks authentication. This can create admin accounts or run arbitrary code, giving attackers full control of the site.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Streamit WordPress theme, all versions up to and including 4.5.0.
Real-world impact
An attacker can create administrator accounts, modify site content, or run arbitrary code, effectively taking over the website.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable without authentication, allows complete compromise of confidentiality, integrity, and availability, and can be used to execute arbitrary code.
What to do about it
- ›Remove or replace the Streamit theme until a patch is released.
- ›If the theme cannot be removed, disable the vulnerable AJAX endpoint or add authentication checks to the code.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description