SECURITYCRITICALCVE-2026-13423

CVE-2026-13423: Streamit WordPress Theme Allows Unauthenticated Arbitrary PHP Function Execution

The Streamit WordPress theme through version 4.5.0 exposes an unauthenticated AJAX route with no authorization or nonce verification, letting any...

Dylan H.

Security Team

July 29, 2026
3 min read
CVE-2026-13423: Streamit WordPress Theme Allows Unauthenticated Arbitrary PHP Function Execution

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Streamit WordPress Theme through 4.5.0

Overview

CVE-2026-13423 is a critical-severity vulnerability (CVSS 9.8) in the Streamit WordPress theme affecting all versions through 4.5.0. The theme registers an AJAX route that performs no authorization check and no WordPress nonce verification, and directly invokes a PHP function named by the attacker with arguments also supplied by the attacker. This constitutes an unauthenticated arbitrary PHP function call primitive.

Technical Details

WordPress themes and plugins commonly register AJAX handlers via wp_ajax_* (authenticated) and wp_ajax_nopriv_* (unauthenticated) hooks. Streamit registers a handler on the unauthenticated nopriv hook that:

  1. Reads the function name from request parameters without sanitisation.
  2. Reads the argument array from request parameters without sanitisation.
  3. Calls call_user_func_array() or equivalent with the attacker-supplied function name and arguments.

Because no nonce or capability check is performed before the invocation, any anonymous HTTP request to wp-admin/admin-ajax.php with the correct action parameter can trigger this handler.

Exploitation Scenarios

This vulnerability class — sometimes called PHP function injection — can be weaponised in several ways depending on what PHP functions are callable in the target environment:

Attacker CallEffect
system('id')OS command execution as web server user
file_put_contents('/path/shell.php', '...')Webshell persistence
wp_create_user('admin2', 'pass')Rogue WordPress admin creation
update_option('siteurl', ...)Site takeover / defacement

Because the attack surface is unauthenticated, it is trivially scriptable and exploitable at scale across all sites running the affected theme version.

Impact

  • Arbitrary code execution as the web server user without any login.
  • Full site compromise — content, user data, and database credentials.
  • Lateral movement to other sites sharing the same server or database host.

Affected Software

ProductAffected Versions
Streamit WordPress ThemeThrough 4.5.0

Remediation

  1. Update the Streamit theme to a patched version. If no patch is available from the theme vendor, consider temporarily deactivating the theme or switching to a safe alternative.
  2. Block AJAX requests to the vulnerable action via WAF or .htaccess rules as an interim measure.
  3. Audit WordPress logs for admin-ajax.php requests with the vulnerable action parameter to determine if exploitation occurred.
  4. Rotate WordPress salts and all admin passwords if exploitation cannot be ruled out.
  5. Scan the site for unexpected PHP files or newly created admin accounts.

References