CVE-2026-104913: Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json

Q: Which sites are exposed to exploitation?

Only sites with an active Freemius Premium license or trial for the plugin are exploitable. The affected code is present in versions through 2.6.0, and the handler relies on the site-level license state rather than a user capability check.

Q: What level of access does an attacker need?

An attacker needs an authenticated WordPress account with subscriber-level access or higher. They can exploit the project-import ZIP handling because the import handler does not enforce a per-user capability check or nonce verification.

Q: What is the potential impact of a successful exploit?

An attacker can place attacker-supplied ZIP members into the WordPress uploads directory without file extension or MIME-type validation. If an uploaded file can be executed in the environment, this may lead to remote code execution.

Q: What condition can be used to assess immediate exposure?

Check whether the plugin is installed at version 2.6.0 or earlier and whether its Freemius Premium license or trial is active. A site without an active Premium license or trial is not exploitable through this handler according to the available information.

Published Nov 7, 2026

Updated

The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.6.0 via the extractzipdata function. This is due to missing capability check, nonce verification, and file extension or MIME type validation before copying attacker-supplied ZIP members to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable on sites where the plugin's Freemius Premium license or trial is active, as the sole gate in the handler is a site-level license check rather than a per-user capability check.

Event History

Nov 7, 2026

CVE Published

via MITRE·02:29 AM

Data Sourced

via MITRE·02:29 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are exposed to exploitation?

Only sites with an active Freemius Premium license or trial for the plugin are exploitable. The affected code is present in versions through 2.6.0, and the handler relies on the site-level license state rather than a user capability check.

What level of access does an attacker need?

An attacker needs an authenticated WordPress account with subscriber-level access or higher. They can exploit the project-import ZIP handling because the import handler does not enforce a per-user capability check or nonce verification.

What is the potential impact of a successful exploit?

An attacker can place attacker-supplied ZIP members into the WordPress uploads directory without file extension or MIME-type validation. If an uploaded file can be executed in the environment, this may lead to remote code execution.

What condition can be used to assess immediate exposure?

Check whether the plugin is installed at version 2.6.0 or earlier and whether its Freemius Premium license or trial is active. A site without an active Premium license or trial is not exploitable through this handler according to the available information.

CVE-2026-104913: Interactive Real Estate <= 2.6.0- Authenticated (Subscriber+) Arbitrary File Upload via Project Import ZIP with Crafted image_map.json

Event History

Frequently Asked Questions

Which sites are exposed to exploitation?

What level of access does an attacker need?

What is the potential impact of a successful exploit?

What condition can be used to assess immediate exposure?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to exploitation?

What level of access does an attacker need?

What is the potential impact of a successful exploit?

What condition can be used to assess immediate exposure?