Overview
CVE-2026-13423 is a critical-severity vulnerability (CVSS 9.8) in the Streamit WordPress theme affecting all versions through 4.5.0. The theme registers an AJAX route that performs no authorization check and no WordPress nonce verification, and directly invokes a PHP function named by the attacker with arguments also supplied by the attacker. This constitutes an unauthenticated arbitrary PHP function call primitive.
Technical Details
WordPress themes and plugins commonly register AJAX handlers via wp_ajax_* (authenticated) and wp_ajax_nopriv_* (unauthenticated) hooks. Streamit registers a handler on the unauthenticated nopriv hook that:
- Reads the function name from request parameters without sanitisation.
- Reads the argument array from request parameters without sanitisation.
- Calls
call_user_func_array()or equivalent with the attacker-supplied function name and arguments.
Because no nonce or capability check is performed before the invocation, any anonymous HTTP request to wp-admin/admin-ajax.php with the correct action parameter can trigger this handler.
Exploitation Scenarios
This vulnerability class — sometimes called PHP function injection — can be weaponised in several ways depending on what PHP functions are callable in the target environment:
| Attacker Call | Effect |
|---|---|
system('id') | OS command execution as web server user |
file_put_contents('/path/shell.php', '...') | Webshell persistence |
wp_create_user('admin2', 'pass') | Rogue WordPress admin creation |
update_option('siteurl', ...) | Site takeover / defacement |
Because the attack surface is unauthenticated, it is trivially scriptable and exploitable at scale across all sites running the affected theme version.
Impact
- Arbitrary code execution as the web server user without any login.
- Full site compromise — content, user data, and database credentials.
- Lateral movement to other sites sharing the same server or database host.
Affected Software
| Product | Affected Versions |
|---|---|
| Streamit WordPress Theme | Through 4.5.0 |
Remediation
- Update the Streamit theme to a patched version. If no patch is available from the theme vendor, consider temporarily deactivating the theme or switching to a safe alternative.
- Block AJAX requests to the vulnerable action via WAF or
.htaccessrules as an interim measure. - Audit WordPress logs for
admin-ajax.phprequests with the vulnerable action parameter to determine if exploitation occurred. - Rotate WordPress salts and all admin passwords if exploitation cannot be ruled out.
- Scan the site for unexpected PHP files or newly created admin accounts.
References
- NVD — CVE-2026-13423
- CVSS Score: 9.8 Critical