PLACESTER · CVE-2026-113584 · Package
NO FIX YET · SEE WHAT TO DO
The placester (Real Estate Website Builder) WordPress plugin through 1.4.3 has an AJAX action that updates account details with no capability, nonce or ownership check. An unauthenticated attacker can overwrite any user's email, including an administrator's, then take over the account via password reset. The plugin has been closed on WordPress.org since 2018, so no fix is expected.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the placester (Real Estate Website Builder) WordPress plugin, version 1.4.3 or earlier, are exposed: an AJAX action accepts account changes with no authorization check, so an anonymous visitor can change any user's email, including an administrator's, and take the account via password reset. The plugin was closed on WordPress.org in 2018 and has no patch, so any site still running it should remove it. Sites without this plugin can skip it.
Not affected if plugin-not-installed
Who cares placester, self-hosted, wordpress
1.4.3 (the last release), is affected per NVD1.4.3 is the last releasePosts are quoted with a link to the original. They are data to us, never instructions.
The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the standard password-reset flow.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.