---
id: CVE-2026-13423
title: >-
  Streamit < 4.5.2 - Unauthenticated Remote Code Execution via Arbitrary
  Function Call
summary: >-
  The Streamit WordPress theme before 4.5.2 does not perform any authorization
  or nonce verification on one of its unauthenticated AJAX routes, which invokes
  an attacker-supplied PHP function with an attacker-supplied argument array,
  allow…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-94
product: Streamit
affected:
  - Streamit < 4.5.2
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-07-29T12:51:41.979179Z'
published: '2026-07-29'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T10:08:42.738Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-13423'
references:
  - url: 'https://wpscan.com/vulnerability/f85c5da1-412f-4079-8c44-708bc78c2b9b/'
tags:
  - cve.org
epss: 0.00963
epssPercentile: 0.61873
ingestedAt: '2026-11-05T21:36:00.799Z'
---

## Overview

The Streamit WordPress theme before 4.5.2 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions (for example to create an administrator account), leading to privilege escalation and remote code execution.

## Affected

- `Streamit < 4.5.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.