{"id":"CVE-2026-104913","kind":"vulnerability","aliases":["CVE-2026-104913"],"related":[],"title":"WordPress real estate floor plan plugin: arbitrary file upload leads to code execution","description":"The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.6.0 via the extract_zip_data function. This is due to missing capability check, nonce verification, and file extension or MIME type validation before copying attacker-supplied ZIP members to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable on sites where the plugin's Freemius Premium license or trial is active, as the sole gate in the handler is a site-level license check rather than a per-user capability check.","summary":"The Interactive Real Estate floor plan WordPress plugin, up to and including 2.6.0, copies attacker-supplied ZIP contents into the uploads directory without checking capability, nonce, or file type. An authenticated subscriber can upload executable files and so run code on the site.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"interactive-real-estate","fixed":["2.6.1"],"affected":"<= 2.6.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["file-upload","package","rce","real-estate-plugin","self-hosted","wordpress"],"not_affected_if":["license-inactive","no-subscriber-accounts","plugin-not-installed"],"how_to_check":"- In WordPress admin > Plugins, check whether 'Interactive Real Estate – Floor Plan & Building Visualizer' (slug interactive-real-estate) is installed at version 2.6.0 or lower\n- Check whether its Freemius Premium license or trial is active; if not, the description says it is not exploitable\n- Check whether subscriber-level accounts exist or registration is open\n- Look in wp-content/uploads for unexpected .php or other executable files, especially recent ones from project imports","fix":"Update Interactive Real Estate – Floor Plan & Building Visualizer to 2.6.1 or later (per Wordfence). Until then, deactivate the plugin, disable open user registration, and block PHP execution in wp-content/uploads.","status":"open","published_at":"2026-11-07T03:16:59+00:00","first_seen_at":"2026-11-07T03:45:32+00:00","triaged_at":"2026-11-07T03:45:36+00:00","updated_at":"2026-11-07T03:46:29+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-07T03:45:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress real estate floor plan plugin: arbitrary file upload leads to code execution","impact":"high","summary":"The Interactive Real Estate floor plan WordPress plugin, up to and including 2.6.0, copies attacker-supplied ZIP contents into the uploads directory without checking capability, nonce, or file type. An authenticated subscriber can upload executable files and so run code on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted","real-estate-plugin"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker uploads executable file and runs code on the server","analyst_note":"Fixed version and vendor patch status are not in the sources; check the WordPress plugin repository changelog for a release after 2.6.0.","how_to_check":"- Check whether the `Interactive Real Estate – Floor Plan & Building Visualizer` plugin is installed and its version is `2.6.0` or lower\n- Check whether its Freemius Premium license or trial is active on the site\n- Look for unexpected executable files in the uploads directory","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","license-inactive","no-subscriber-accounts"],"who_is_affected":"Sites running the Interactive Real Estate floor plan plugin at version 2.6.0 or earlier, where the premium license or trial is active. Any subscriber-level account can exploit it, so sites with open registration are most exposed. Sites without the plugin or with the license inactive are not affected according to the description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4373,"output_tokens":605,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed version and vendor patch status are not in the sources; check the WordPress plugin repository changelog for a release after 2.6.0.","search":"'-104913':16A,19A '-2026':15A,18A '2.6.0':49B,105C 'access':150C 'activ':183C 'arbitrari':7A,95C 'attack':52B,131C,145C 'attacker-suppli':51B,130C 'authent':68B,144C 'build':87C 'capabl':62B,117C,204C 'check':61B,118C,197C,205C 'code':12A,77B,163C 'content':55B 'copi':50B,129C 'cve':14A,17A 'data':110C 'directori':59B,138C 'due':114C 'estat':3A,31B,40B,84C 'estate':23A 'execut':13A,72B,159C,164C 'exploit':170C 'extens':123C 'extract':108C 'file':8A,25B,65B,73B,96C,122C,155C 'file-upload':24B 'floor':4A,41B,85C 'freemius':177C 'function':111C 'gate':187C 'handler':190C 'host':35B 'includ':48B,104C 'interact':38B,82C 'interactive':21A 'interactive-real-estate':20A 'lead':10A 'level':149C,195C 'licens':179C,196C 'make':140C,161C 'may':157C 'member':134C 'mime':125C 'miss':116C 'nonc':63B,119C 'packag':27B 'per':202C 'per-us':201C 'plan':5A,42B,86C 'plugin':6A,32B,44B,89C,175C 'possibl':142C,165C 'premium':178C 'rather':198C 'rce':28B 'real':2A,22A,30B,39B,83C 'real-estate-plugin':29B 'remot':162C 'run':76B 'self':34B 'self-host':33B 'site':80B,172C,194C 'site-level':193C 'sole':186C 'subscrib':69B,148C 'subscriber-level':147C 'suppli':53B,132C 'trial':181C 'type':66B,126C 'upload':9A,26B,58B,71B,97C,137C,154C 'user':203C 'valid':127C 'verif':120C 'version':100C 'via':106C 'visual':88C 'vulner':93C,167C 'without':60B 'wordpress':1A,36B,43B,91C 'zip':54B,109C,133C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Interactive Real Estate floor plan plugin at version 2.6.0 or earlier, where the premium license or trial is active. Any subscriber-level account can exploit it, so sites with open registration are most exposed. Sites without the plugin or with the license inactive are not affected according to the description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["interactiverealestate"],"ptokens":["estate","interactive","real"],"labels":["fileupload","high","package","rce","realestateplugin","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-104913':16A,19A '-2026':15A,18A 'arbitrari':7A 'code':12A 'cve':14A,17A 'estat':3A 'estate':23A 'execut':13A 'file':8A 'floor':4A 'interactive':21A 'interactive-real-estate':20A 'lead':10A 'plan':5A 'plugin':6A 'real':2A,22A 'upload':9A 'wordpress':1A","search_b":"'2.6.0':49B 'attack':52B 'attacker-suppli':51B 'authent':68B 'capabl':62B 'check':61B 'code':77B 'content':55B 'copi':50B 'directori':59B 'estat':31B,40B 'execut':72B 'file':25B,65B,73B 'file-upload':24B 'floor':41B 'host':35B 'includ':48B 'interact':38B 'nonc':63B 'packag':27B 'plan':42B 'plugin':32B,44B 'rce':28B 'real':30B,39B 'real-estate-plugin':29B 'run':76B 'self':34B 'self-host':33B 'site':80B 'subscrib':69B 'suppli':53B 'type':66B 'upload':26B,58B,71B 'without':60B 'wordpress':36B,43B 'zip':54B","search_c":"'2.6.0':105C 'access':150C 'activ':183C 'arbitrari':95C 'attack':131C,145C 'attacker-suppli':130C 'authent':144C 'build':87C 'capabl':117C,204C 'check':118C,197C,205C 'code':163C 'copi':129C 'data':110C 'directori':138C 'due':114C 'estat':84C 'execut':159C,164C 'exploit':170C 'extens':123C 'extract':108C 'file':96C,122C,155C 'floor':85C 'freemius':177C 'function':111C 'gate':187C 'handler':190C 'includ':104C 'interact':82C 'level':149C,195C 'licens':179C,196C 'make':140C,161C 'may':157C 'member':134C 'mime':125C 'miss':116C 'nonc':119C 'per':202C 'per-us':201C 'plan':86C 'plugin':89C,175C 'possibl':142C,165C 'premium':178C 'rather':198C 'real':83C 'remot':162C 'site':172C,194C 'site-level':193C 'sole':186C 'subscrib':148C 'subscriber-level':147C 'suppli':132C 'trial':181C 'type':126C 'upload':97C,137C,154C 'user':203C 'valid':127C 'verif':120C 'version':100C 'via':106C 'visual':88C 'vulner':93C,167C 'wordpress':91C 'zip':109C,133C","first_public_at":"2026-11-07T03:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104913","severity":null,"published_at":"2026-11-07T03:16:59+00:00","modified_at":"2026-11-07T03:16:59+00:00","first_seen_at":"2026-11-07T03:45:32+00:00","fetched_at":"2026-11-07T03:45:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-104913:1946","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/interactive-real-estate/interactive-real-estate-260-authenticated-subscriber-arbitrary-file-upload-via-project-import-zip-with-crafted-image-mapjson","severity":null,"published_at":"2026-11-07T03:46:29+00:00","modified_at":"2026-11-07T03:46:29+00:00","first_seen_at":"2026-11-07T03:46:29+00:00","fetched_at":"2026-11-07T03:46:29+00:00","note":"Wordfence advisory (CVE assigner, not the vendor) lists patched version 2.6.1, affected <=2.6.0; the vendor changelog (wordpress.org trac/svn) could not be fetched, so fix is not marked verified. No exploitation or PoC found; I did not search X or Bluesky (tier B). Exploitable only with an active Freemius Premium license or trial; any subscriber-level account is enough. Vulnerable path is the project import ZIP (extract_zip_data, crafted image_map.json).","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/interactive-real-estate/interactive-real-estate-260-authenticated-subscriber-arbitrary-file-upload-via-project-import-zip-with-crafted-image-mapjson","https://wordpress.org/plugins/interactive-real-estate/"]}],"documents":[{"id":92522,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/interactive-real-estate/interactive-real-estate-260-authenticated-subscriber-arbitrary-file-upload-via-project-import-zip-with-crafted-image-mapjson","title":"Wordfence: Interactive Real Estate <= 2.6.0 Subscriber+ Arbitrary File Upload","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":92523,"url":"https://wordpress.org/plugins/interactive-real-estate/","title":"Interactive Real Estate plugin page (wordpress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}