---
id: "CVE-2026-104913"
page: "https://infrastack.ai/live/CVE-2026-104913"
kind: "vulnerability"
aliases: ["CVE-2026-104913"]
title: "WordPress real estate floor plan plugin: arbitrary file upload leads to code execution"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "interactive-real-estate", "fixed": ["2.6.1"], "affected": "<= 2.6.0", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["file-upload", "package", "rce", "real-estate-plugin", "self-hosted", "wordpress"]
not_affected_if: ["license-inactive", "no-subscriber-accounts", "plugin-not-installed"]
published_at: "2026-11-07T03:16:59+00:00"
first_seen_at: "2026-11-07T03:45:32+00:00"
updated_at: "2026-11-07T03:46:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104913", "first_seen_at": "2026-11-07T03:45:32+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/interactive-real-estate/interactive-real-estate-260-authenticated-subscriber-arbitrary-file-upload-via-project-import-zip-with-crafted-image-mapjson", "first_seen_at": "2026-11-07T03:46:29+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/interactive-real-estate/interactive-real-estate-260-authenticated-subscriber-arbitrary-file-upload-via-project-import-zip-with-crafted-image-mapjson", "https://wordpress.org/plugins/interactive-real-estate/"]}]
exploit_sources: []
---

# WordPress real estate floor plan plugin: arbitrary file upload leads to code execution

Link for people: https://infrastack.ai/live/CVE-2026-104913 (this .md is for agents)

The Interactive Real Estate floor plan WordPress plugin, up to and including 2.6.0, copies attacker-supplied ZIP contents into the uploads directory without checking capability, nonce, or file type. An authenticated subscriber can upload executable files and so run code on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:interactive-real-estate affected <= 2.6.0 fixed 2.6.1

## How to check

- In WordPress admin > Plugins, check whether 'Interactive Real Estate – Floor Plan & Building Visualizer' (slug interactive-real-estate) is installed at version 2.6.0 or lower
- Check whether its Freemius Premium license or trial is active; if not, the description says it is not exploitable
- Check whether subscriber-level accounts exist or registration is open
- Look in wp-content/uploads for unexpected .php or other executable files, especially recent ones from project imports

## Fix

Update Interactive Real Estate – Floor Plan & Building Visualizer to 2.6.1 or later (per Wordfence). Until then, deactivate the plugin, disable open user registration, and block PHP execution in wp-content/uploads.

## Timeline

- 2026-11-07T03:45:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104913
- 2026-11-07T03:46:29+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/interactive-real-estate/interactive-real-estate-260-authenticated-subscriber-arbitrary-file-upload-via-project-import-zip-with-crafted-image-mapjson — Wordfence advisory (CVE assigner, not the vendor) lists patched version 2.6.1, affected <=2.6.0; the vendor changelog (wordpress.org trac/svn) could not be fetched, so fix is not marked verified. No exploitation or PoC found; I did not search X or Bluesky (tier B). Exploitable only with an active Freemius Premium license or trial; any subscriber-level account is enough. Vulnerable path is the project import ZIP (extract_zip_data, crafted image_map.json).

## Documents

- [advisory] Wordfence: Interactive Real Estate <= 2.6.0 Subscriber+ Arbitrary File Upload https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/interactive-real-estate/interactive-real-estate-260-authenticated-subscriber-arbitrary-file-upload-via-project-import-zip-with-crafted-image-mapjson
- [describes] Interactive Real Estate plugin page (wordpress.org) https://wordpress.org/plugins/interactive-real-estate/

## From the sources

The Interactive Real Estate – Floor Plan & Building Visualizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.6.0 via the extract_zip_data function. This is due to missing capability check, nonce verification, and file extension or MIME type validation before copying attacker-supplied ZIP members to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. This vulnerability is only exploitable on sites where the plugin's Freemius Premium license or trial is active, as the sole gate in the handler is a site-level license check rather than a per-user capability check.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_