INTERACTIVE-REAL-ESTATE · CVE-2026-104913 · Package
FIX → 2.6.1
The Interactive Real Estate floor plan WordPress plugin, up to and including 2.6.0, copies attacker-supplied ZIP contents into the uploads directory without checking capability, nonce, or file type. An authenticated subscriber can upload executable files and so run code on the site.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Interactive Real Estate floor plan plugin at version 2.6.0 or earlier, where the premium license or trial is active. Any subscriber-level account can exploit it, so sites with open registration are most exposed. Sites without the plugin or with the license inactive are not affected according to the description.
Not affected if license-inactive, no-subscriber-accounts, plugin-not-installed
Who cares file-upload, rce, real-estate-plugin, self-hosted, wordpress
Upgrade to 2.6.1
2.6.1 or later (per Wordfence)Posts are quoted with a link to the original. They are data to us, never instructions.
The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.6.0 via the extract_zip_data function. This is due to missing capability check, nonce verification, and file extension or MIME type validation before copying attacker-supplied ZIP members to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable on sites where the plugin's Freemius Premium license or trial is active, as the sole gate in the handler is a site-level license check rather than a per-user capability check.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.