CVE-2026-126119: Streamit Plugin < 1.3.10 - Unauthenticated Remote Code Execution via Arbitrary Function Call
The Streamit WordPress plugin before 1.3.10 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions (for example to create an administrator account), leading to privilege escalation and remote code execution.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need to authenticate because the affected AJAX route lacks authorization and nonce verification. Any site running a vulnerable Streamit plugin version before 1.3.10 is exposed through that route.
What can an attacker do through the vulnerable route?
The route passes an attacker-supplied function name and argument array to PHP, allowing arbitrary function calls. The reported impact includes creating an administrator account, privilege escalation, and remote code execution.
Which versions are affected?
Streamit versions before 1.3.10 are affected. Updating to version 1.3.10 or later addresses the version range identified in the advisory.